Medium severity · published Aug 4, 2026
CVE-2026-18723
diaowen DWSurvey Survey Status up-survey-status.do improper authorization
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
DWSurvey · diaowen
6.0; 6.1; 6.2; 6.3; 6.4; 6.5; +9 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18723
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18723
drive.google.com
https://drive.google.com/file/d/1Ziv1My5IHNnEobdHOwCfx7d6eHUs-gnS/view?usp=sharing
vuldb.com
https://vuldb.com/cve/CVE-2026-18723
vuldb.com
https://vuldb.com/submit/856184
vuldb.com
https://vuldb.com/vuln/385634
vuldb.com
https://vuldb.com/vuln/385634/cti
More from DWSurvey
9.8
CVE-2023-40980
File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the…
9.8
CVE-2021-39384
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java
9.8
CVE-2021-39383
DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java
7.5
CVE-2025-63248
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control
6.3
CVE-2026-18722
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization