CVE-2026-18723: DWSurvey Auth Bypass Vulnerability

CVE-2026-18723 Overview

CVE-2026-18723 is an improper authorization vulnerability [CWE-266] in diaowen DWSurvey through version 6.14.0. The flaw affects an unknown function within /api/dwsurvey/app/survey/up-survey-status.do, part of the Survey Status Handler component. An authenticated remote attacker with low privileges can manipulate the request to bypass authorization checks and alter survey status data.

The exploit has been publicly disclosed, though no active exploitation has been confirmed. The vendor was contacted about the disclosure but did not respond. Impact is limited to low confidentiality, integrity, and availability effects on the survey application.

Critical Impact
Authenticated remote attackers can modify survey status records they should not be permitted to change, potentially disrupting survey workflows and data integrity.

Affected Products

diaowen DWSurvey versions up to and including 6.14.0
Survey Status Handler component (up-survey-status.do endpoint)
Deployments exposing the /api/dwsurvey/app/survey/ API path

Discovery Timeline

2026-08-04 - CVE CVE-2026-18723 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18723

Vulnerability Analysis

The vulnerability resides in the survey status update handler at /api/dwsurvey/app/survey/up-survey-status.do. This endpoint processes requests to change the state of survey objects but fails to properly verify whether the requesting user holds the correct authorization for the targeted survey resource.

An attacker holding a low-privileged authenticated session can send crafted requests to this endpoint and influence survey status attributes belonging to other users or contexts. The improper authorization pattern maps to [CWE-266] Incorrect Privilege Assignment, indicating the application grants effective privileges beyond what the user's role should permit.

Because the attack is network-reachable and requires no user interaction beyond authentication, exposure grows significantly when DWSurvey instances are published to the internet. The publicly disclosed proof of concept lowers the barrier to exploitation.

Root Cause

The root cause is a missing or insufficient authorization check within the server-side logic backing the up-survey-status.do endpoint. The handler accepts status-change parameters and performs the update without validating that the authenticated principal owns or has been granted rights to modify the referenced survey.

Attack Vector

Exploitation occurs over the network against an accessible DWSurvey instance. The attacker authenticates with any valid low-privilege account, then issues HTTP requests to the Survey Status Handler endpoint referencing survey identifiers outside the attacker's authorized scope. The server processes the state transition without rejecting the unauthorized action.

No verified exploit code is published in the referenced advisories. Technical details are available in the VulDB CVE-2026-18723 entry and the associated VulDB Vulnerability #385634 record.

Detection Methods for CVE-2026-18723

Indicators of Compromise

HTTP requests to /api/dwsurvey/app/survey/up-survey-status.do from authenticated sessions targeting survey IDs not owned by the requesting user.
Unexpected changes to survey status fields in the DWSurvey application database with no corresponding administrative action.
Repeated status-update calls from a single low-privilege account touching many distinct survey identifiers.

Detection Strategies

Enable application-level audit logging for all requests to endpoints under /api/dwsurvey/app/survey/ and correlate the requesting user ID with the survey owner.
Deploy web application firewall (WAF) rules that flag or block requests to up-survey-status.do when the session role does not match the target resource owner.
Baseline normal survey-status transition patterns and alert on deviations such as bulk updates or updates outside business hours.

Monitoring Recommendations

Forward DWSurvey application logs and reverse proxy access logs to a centralized SIEM for correlation and long-term retention.
Monitor authentication logs for low-privilege accounts exhibiting unusual API traffic volume against the survey endpoints.
Track database writes to survey status columns and alert when the modifying user does not match the record owner.

How to Mitigate CVE-2026-18723

Immediate Actions Required

Restrict network exposure of DWSurvey instances by placing them behind authenticated VPN access or an IP allowlist until a patched version is available.
Audit existing user accounts and revoke unnecessary low-privilege access to reduce the pool of accounts capable of triggering the flaw.
Review recent survey status changes for unauthorized modifications and restore expected values where tampering is identified.

Patch Information

No vendor patch has been published at the time of writing. According to the disclosure record, the vendor was contacted about this vulnerability but did not respond. Organizations should monitor the diaowen DWSurvey project advisory pages and apply security updates as soon as they become available.

Workarounds

Block or restrict access to the /api/dwsurvey/app/survey/up-survey-status.do endpoint at a reverse proxy or WAF for accounts that do not require survey-management capabilities.
Implement compensating server-side authorization checks in front of DWSurvey via an API gateway that validates the caller's ownership of the survey ID before forwarding requests.
Reduce the account inventory to trusted administrators only while the vulnerability remains unpatched, disabling self-registration if enabled.

bash

# Example NGINX snippet to restrict access to the vulnerable endpoint
location = /api/dwsurvey/app/survey/up-survey-status.do {
    allow 10.0.0.0/8;      # internal administrative network
    deny all;
    proxy_pass http://dwsurvey_backend;
}