CVE-2026-18722 Overview
CVE-2026-18722 is an authorization bypass vulnerability in diaowen DWSurvey versions up to 6.14.0. The flaw resides in the DwDeisgnSurveyController.devSurvey function within the /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do endpoint of the Survey Handler component. Attackers with low-privileged network access can manipulate the request to bypass authorization checks. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-285: Improper Authorization.
Critical Impact
Remote authenticated attackers can bypass authorization controls in the survey design endpoint, gaining access to functionality or data outside their intended scope.
Affected Products
- diaowen DWSurvey versions up to and including 6.14.0
- Component: Survey Handler (DwDeisgnSurveyController.devSurvey)
- Endpoint: /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do
Discovery Timeline
- 2026-08-04 - CVE-2026-18722 published to the National Vulnerability Database (NVD)
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-18722
Vulnerability Analysis
The vulnerability affects DWSurvey, an open-source survey platform maintained by diaowen. The flaw exists in the devSurvey handler exposed at /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do. This endpoint fails to properly enforce authorization checks before performing survey design operations.
An attacker with low-level authenticated access can manipulate request parameters to invoke survey operations they should not be entitled to perform. According to VulDB, the exploit has been made public, increasing the likelihood of opportunistic abuse. The vendor did not respond to disclosure, so no coordinated patch guidance is currently available.
The EPSS probability for this CVE is 0.211%, reflecting low current exploitation likelihood, but the public exploit disclosure raises the operational risk for exposed deployments.
Root Cause
The root cause is improper authorization ([CWE-285]) in the DwDeisgnSurveyController.devSurvey method. The controller processes design-survey requests without validating whether the authenticated principal owns the target resource or possesses the required role. This omission allows a low-privileged account to act on surveys belonging to other users.
Attack Vector
Exploitation requires network access to the DWSurvey application and low-level credentials. The attacker crafts an HTTP request to /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do with parameters referencing resources outside their authorized scope. Because the vulnerable handler does not verify ownership or role, the backend processes the request as if authorized.
The vulnerability manifests in the authorization check within the survey design controller. Technical details are documented in the VulDB CVE-2026-18722 entry and the associated disclosure document.
Detection Methods for CVE-2026-18722
Indicators of Compromise
- Unusual HTTP requests to /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do from low-privileged accounts
- Modifications to survey design objects owned by other users without a corresponding administrative session
- Access patterns where a single authenticated user interacts with survey IDs across many distinct owners
Detection Strategies
- Review web server and application logs for requests to the dev-survey.do endpoint and correlate the authenticated user with the target survey owner
- Alert on authenticated sessions that enumerate or reference survey IDs outside the user's own dataset
- Deploy web application firewall rules to log and inspect parameter values sent to the DWSurvey v6 API surface
Monitoring Recommendations
- Enable verbose access logging on the DWSurvey application server, capturing user identifiers alongside request URIs
- Forward application and web tier logs to a centralized analytics platform for behavioral baselining
- Track failed and successful authorization decisions in DWSurvey to detect anomalous privilege usage
How to Mitigate CVE-2026-18722
Immediate Actions Required
- Restrict network exposure of DWSurvey instances to trusted networks or VPN-only access until a fix is available
- Audit existing DWSurvey user accounts and disable inactive or unnecessary low-privileged accounts
- Review survey data for signs of unauthorized modification, particularly on the dev-survey.do endpoint
Patch Information
As of the CVE publication date, the vendor has not issued a patch and did not respond to disclosure attempts. Monitor the diaowen DWSurvey project for future security releases. Organizations should track upstream releases beyond version 6.14.0 for a corrective update.
Workarounds
- Place DWSurvey behind an authenticating reverse proxy that enforces additional access controls per-endpoint
- Apply WAF rules to block or challenge requests to /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do from non-administrative users
- Implement network-layer segmentation to limit which internal users can reach the DWSurvey management API
- Consider temporarily disabling the survey design endpoint if it is not required for business operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
