CVE-2026-18722 in DWSurvey
Summary
by MITRE • 08/04/2026
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The diaowen DWSurvey vulnerability represents a critical authorization bypass flaw within the Survey Handler component of version 6.14.0 and earlier. This security weakness exists specifically within the DwDeisgnSurveyController.devSurvey function located at /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do, where improper access controls allow unauthorized users to bypass legitimate authentication mechanisms. The vulnerability's exposure through a remote attack vector significantly amplifies its potential impact, as malicious actors can exploit this flaw without requiring physical access or local network presence. This authorization bypass enables attackers to gain elevated privileges and access restricted survey development functionalities that should only be available to authorized administrators or legitimate users.
The technical implementation of this vulnerability stems from insufficient input validation and access control checks within the survey development endpoint. When processing requests to the dev-survey.do API endpoint, the system fails to properly verify user credentials or authorization levels before granting access to survey design features. This flaw allows any remote attacker to manipulate the application's authentication flow and potentially gain unauthorized access to survey creation, modification, or deletion capabilities. The vulnerability manifests as a failure in the principle of least privilege, where users with minimal or no authorization can perform actions typically restricted to administrators or authenticated users.
The operational impact of this authorization bypass vulnerability extends beyond simple data access, potentially enabling full compromise of the survey system's integrity and confidentiality. An attacker could exploit this flaw to create malicious surveys, modify existing survey configurations, or manipulate survey responses, leading to potential data breaches, information disclosure, or service disruption. The public availability of exploit code significantly increases the risk profile, as it removes the barrier to entry for attackers who may not possess advanced technical skills. This vulnerability directly relates to CWE-285, which addresses improper authorization issues in software systems, and aligns with ATT&CK technique T1078 for valid accounts and privilege escalation.
Organizations utilizing DWSurvey versions 6.14.0 or earlier must implement immediate mitigation strategies to protect their survey infrastructure from exploitation. The primary recommendation involves applying the latest vendor patches or updates as soon as they become available, though in this case the vendor's lack of response presents additional challenges for remediation. Network-level controls should be implemented to restrict access to the vulnerable API endpoint, particularly through firewall rules that limit access to trusted IP addresses or require additional authentication layers. Additionally, monitoring systems should be configured to detect unusual patterns of access to the dev-survey endpoint, as unauthorized attempts to access survey development features would likely generate anomalous traffic patterns that could serve as early warning indicators of exploitation attempts.