EUVD-2026-52571
GHSA-mf5p-w73p-97vh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring low-privilege authentication; partial CIA impact scoped to survey data with no privilege escalation or scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authorization bypass in DWSurvey up to version 6.14.0 permits remote authenticated attackers to manipulate user-controlled keys in the Survey Handler's devSurvey function, bypassing access controls on the /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do endpoint. The flaw (CWE-639, Insecure Direct Object Reference class) allows unauthorized read or write access to survey resources belonging to other users. A public proof-of-concept exploit is available and the vendor has not responded to disclosure, leaving no official patch for deployed instances.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) identifies this as an IDOR vulnerability: the application fails to validate that the resource identifier supplied by an authenticated user in the API request actually belongs to that user's authorization scope. The vulnerable code path is the devSurvey method within DwDeisgnSurveyController, a Java-based REST controller in DWSurvey - an open-source online survey platform maintained by diaowen. The affected endpoint /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do exposes survey design/development operations and accepts a user-controlled key (likely a survey ID) without enforcing ownership checks server-side. CPE cpe:2.3:a:diaowen:dwsurvey:*:*:*:*:*:*:*:* covers all releases through 6.14.0.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure, and no fixed version is confirmed. As an immediate compensating control, administrators should enforce strict server-side authorization validation at the API gateway or WAF layer for the /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do endpoint, rejecting requests where the survey resource ID does not match the authenticated user's ownership scope; note this requires WAF rule tuning and may produce false positives on legitimate survey-sharing workflows. If the DWSurvey instance is internet-facing and multi-tenant, consider restricting the endpoint to internal network access only, accepting the trade-off of reduced remote usability. Monitor https://vuldb.com/vuln/385633 and the diaowen project repository for any future patch releases. Organizations with high data-sensitivity requirements should evaluate replacing or isolating the deployment until a vendor fix is confirmed.
File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter. Rated
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter. Rated
Improper authorization in diaowen DWSurvey (all versions through 6.14.0) permits authenticated low-privileged users to i
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. Rated high severity (CVSS 7.5), this vulnerability is remotel
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today