Medium severity · published Aug 4, 2026
CVE-2026-18722
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
DWSurvey · diaowen
6.0; 6.1; 6.2; 6.3; 6.4; 6.5; +9 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18722
drive.google.com
https://drive.google.com/file/d/1S4_tO4YGk4schmB7AIZa3dq3wGxgfN8T/view?usp=sharing
vuldb.com
https://vuldb.com/cve/CVE-2026-18722
vuldb.com
https://vuldb.com/submit/856183
vuldb.com
https://vuldb.com/vuln/385633
vuldb.com
https://vuldb.com/vuln/385633/cti
More from DWSurvey
9.8
CVE-2023-40980
File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the…
9.8
CVE-2021-39384
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java
9.8
CVE-2021-39383
DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java
7.5
CVE-2025-63248
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control
6.3
CVE-2026-18723
diaowen DWSurvey Survey Status up-survey-status.do improper authorization