CVE-2026-18723

Summary

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
diaowenDWSurvey6.0affected
diaowenDWSurvey6.1affected
diaowenDWSurvey6.2affected
diaowenDWSurvey6.3affected
diaowenDWSurvey6.4affected
diaowenDWSurvey6.5affected
diaowenDWSurvey6.6affected
diaowenDWSurvey6.7affected
diaowenDWSurvey6.8affected
diaowenDWSurvey6.9affected
diaowenDWSurvey6.10affected
diaowenDWSurvey6.11affected
diaowenDWSurvey6.12affected
diaowenDWSurvey6.13affected
diaowenDWSurvey6.14.0affected

Weaknesses

  • CWE-285: Improper Authorization
  • CWE-266: Incorrect Privilege Assignment

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References