CVE-2026-18723
📛 CVE Title
diaowen DWSurvey Survey Status up-survey-status.do improper authorization
Description
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulDB
- CVSS severity
- MEDIUM
- CVSS score
- 5.3 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P- Effective score
- 5.3 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-285,CWE-266 - Reserved
- 2026-08-03
- Published
- 2026-08-04 03:15 UTC
- Last updated
- 2026-08-04 15:03 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18723.json
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-52572
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| diaowen | DWSurvey |
6.0 (affected),
6.1 (affected),
6.2 (affected),
6.3 (affected),
6.4 (affected),
6.5 (affected),
6.6 (affected),
6.7 (affected),
6.8 (affected),
6.9 (affected),
6.10 (affected),
6.11 (affected),
6.12 (affected),
6.13 (affected),
6.14.0 (affected)
|
— |
Vendor references (5)
References embedded in the original CVE record by the assigning CNA.
- VDB-385634 | diaowen DWSurvey Survey Status up-survey-status.do improper authorization vdb-entry
- VDB-385634 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
- CVE-2026-18723 | CVE Analysis and Report third-party-advisory
- Submit #856184 | diaowen DWSurvey v6.14.0 Improper Access Controls third-party-advisory
- https://drive.google.com/file/d/1Ziv1My5IHNnEobdHOwCfx7d6eHUs-gnS/view?usp=sharing exploit
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-18723.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18723",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T13:26:58.648501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T15:03:22.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:diaowen:dwsurvey:*:*:*:*:*:*:*:*"
],
"modules": [
"Survey Status Handler"
],
"product": "DWSurvey",
"vendor": "diaowen",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "6.5"
},
{
"status": "affected",
"version": "6.6"
},
{
"status": "affected",
"version": "6.7"
},
{
"status": "affected",
"version": "6.8"
},
{
"status": "affected",
"version": "6.9"
},
{
"status": "affected",
"version": "6.10"
},
{
"status": "affected",
"version": "6.11"
},
{
"status": "affected",
"version": "6.12"
},
{
"status": "affected",
"version": "6.13"
},
{
"status": "affected",
"version": "6.14.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Stephen Lin (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T03:15:07.565Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385634 | diaowen DWSurvey Survey Status up-survey-status.do improper authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/385634"
},
{
"name": "VDB-385634 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385634/cti"
},
{
"name": "CVE-2026-18723 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18723"
},
{
"name": "Submit #856184 | diaowen DWSurvey v6.14.0 Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856184"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Ziv1My5IHNnEobdHOwCfx7d6eHUs-gnS/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T19:55:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "diaowen DWSurvey Survey Status up-survey-status.do improper authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18723",
"datePublished": "2026-08-04T03:15:07.565Z",
"dateReserved": "2026-08-03T17:50:39.260Z",
"dateUpdated": "2026-08-04T15:03:22.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}