CVE-2026-18722

Summary

A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
diaowenDWSurvey6.0affected
diaowenDWSurvey6.1affected
diaowenDWSurvey6.2affected
diaowenDWSurvey6.3affected
diaowenDWSurvey6.4affected
diaowenDWSurvey6.5affected
diaowenDWSurvey6.6affected
diaowenDWSurvey6.7affected
diaowenDWSurvey6.8affected
diaowenDWSurvey6.9affected
diaowenDWSurvey6.10affected
diaowenDWSurvey6.11affected
diaowenDWSurvey6.12affected
diaowenDWSurvey6.13affected
diaowenDWSurvey6.14.0affected

Weaknesses

  • CWE-639: Authorization Bypass
  • CWE-285: Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References