The vulnerability lies in the DwDeisgnSurveyController.devSurvey function of the DWSurvey application. An attacker can invoke the /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do endpoint and bypass normal authorization checks, potentially reading or altering survey content. The weakness aligns with CWE-285, Missing Authorization, and CWE-639, Authorization Bypass Through User‑Controlled Key, indicating that improper verification of user privileges is at fault. As a result, unauthenticated or poorly authenticated users may gain unauthorized access to sensitive survey information, leading to confidentiality leakage or data tampering.

This issue affects diaowen’s DWSurvey product, specifically versions up to and including 6.14.0. The vulnerability is present in the Survey Handler component of the application. No newer versions are listed as affected.

The CVSS score of 5.3 suggests a moderate severity. EPSS data is not available, so the exploitation likelihood cannot be quantified, but the CVE description states that the exploit has been made public and can be launched remotely. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed, widespread attacks yet, but the remote nature and lack of vendor response mean that organizations using the affected versions should consider the risk of unauthorized access. The likely attack vector is a remote request to the exposed endpoint, and if an attacker can craft the request (e.g., by controlling input values), they can bypass normal authorization checks.