CVE-2026-18722
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was found in DWSurvey up to version 6.14.0 in the function DwDeisgnSurveyController.devSurvey in the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do. Manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been made public.
Risk Assessment
Authorization bypass may allow unauthorized users to access survey functionality, potentially leading to data confidentiality breaches or unauthorized modifications.
Recommendation
Update DWSurvey to the latest available version if any, or apply available patches. Restrict access to the vulnerable endpoint and monitor logs for suspicious requests.
Other vulnerabilities in DWSurvey
See all- CVE-2026-75325Critical
DWSurvey v6.14.0 is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
- CVE-2026-18723Medium
A vulnerability in DWSurvey up to 6.14.0 affects an unknown function in the file /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler component. This manipulation causes improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-63248High
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire can enable the deletion of other questionnaires.
Original NVD description (English source)
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS