Description
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Survey Status Handler component of diaowen DWSurvey, where an unknown function within the /api/dwsurvey/app/survey/up-survey-status.do endpoint can be manipulated to bypass normal authorization controls (CWE-266, CWE-285). The flaw allows remote exploitation by sending crafted requests, enabling an attacker who can reach the endpoint to alter or view survey status information without proper authentication, potentially leading to unauthorized data disclosure or privilege elevation.

Affected Systems

All installations of diaowen DWSurvey up to version 6.14.0 are affected, regardless of deployment configuration, since the flaw exists in the Survey Status Handler of those releases.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score is under 1%, suggesting a low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending crafted requests to the endpoint; no local access or privileged credentials are required, making the threat realistic in environments where the endpoint is exposed to untrusted networks.

Generated by OpenCVE AI on August 4, 2026 at 21:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict network access to the /api/dwsurvey/app/survey/up-survey-status.do endpoint so that only authenticated and authorized users can reach it, for example by enforcing firewall rules or gateway policies.
  • Monitor application logs for any use of up-survey-status.do and investigate anomalous activity to detect potential exploitation attempts.
  • Check diaowen’s official channels for an updated release that addresses the authorization bypass; if a patch is released, upgrade to that version as soon as possible.

Generated by OpenCVE AI on August 4, 2026 at 21:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title diaowen DWSurvey Survey Status up-survey-status.do improper authorization
First Time appeared Diaowen
Diaowen dwsurvey
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:diaowen:dwsurvey:*:*:*:*:*:*:*:*
Vendors & Products Diaowen
Diaowen dwsurvey
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Diaowen Dwsurvey
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T15:03:22.366Z

Reserved: 2026-08-03T17:50:39.260Z

Link: CVE-2026-18723

cve-icon Vulnrichment

Updated: 2026-08-04T13:27:03.885Z

cve-icon NVD

Status : Deferred

Published: 2026-08-04T04:16:32.493

Modified: 2026-08-12T20:59:00.027

Link: CVE-2026-18723

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:45:04Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization