CVE-2026-18722
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability was found in DWSurvey up to version 6.14.0 in the function DwDeisgnSurveyController.devSurvey in the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do. Manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been made public.
Risk Assessment
Authorization bypass may allow unauthorized users to access survey functionality, potentially leading to data confidentiality breaches or unauthorized modifications.
Recommendation
Update DWSurvey to the latest available version if any, or apply available patches. Restrict access to the vulnerable endpoint and monitor logs for suspicious requests.
Other vulnerabilities in DWSurvey
See all- CVE-2026-75325Critical
DWSurvey v6.14.0 is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
- CVE-2026-18723Medium
A vulnerability in DWSurvey up to 6.14.0 affects an unknown function in the file /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler component. This manipulation causes improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.