Is there a public PoC exploit available for CVE-2026-18723?

Yes, a public proof-of-concept exploit is available for CVE-2026-18723. Prioritise patching immediately. EPSS: 0.2%.

DWSurvey CVE-2026-18723

Q: What is the CVSS score of CVE-2026-18723?

CVE-2026-18723 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52572 LOW

Improper Authorization (CWE-285)

2026-08-04 VulDB

GHSA-jx8x-5xxr-99x9

Authentication Bypass Dwsurvey Diaowen

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requiring a low-privileged session (PR:L); authorization bypass yields partial read, write, and availability impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 04, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Aug 04, 2026 - 04:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 04, 2026 - 03:59 vuln.today

CVE Published

Aug 04, 2026 - 03:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in diaowen DWSurvey (all versions through 6.14.0) permits authenticated low-privileged users to invoke the Survey Status Handler endpoint beyond their intended access level, enabling unauthorized manipulation of survey state - such as publishing, closing, or altering surveys owned by other accounts. The affected endpoint /api/dwsurvey/app/survey/up-survey-status.do is remotely reachable and lacks sufficient authorization enforcement. A public proof-of-concept exploit has been disclosed via Google Drive; no vendor patch exists as the vendor did not respond to responsible disclosure, leaving all current deployments unmitigated.

Technical ContextAI

DWSurvey is a Java-based open-source online survey platform developed by diaowen. The vulnerability is located in the Survey Status Handler component, specifically the API endpoint /api/dwsurvey/app/survey/up-survey-status.do, which processes survey lifecycle state transitions. The root cause is CWE-285 (Improper Authorization), meaning the application either omits or incorrectly implements an authorization check at the function level - failing to verify whether the authenticated caller holds sufficient rights over the targeted survey resource. This is a broken object-level authorization (BOLA/IDOR-class) issue on a status-mutation endpoint. The CPE cpe:2.3:a:diaowen:dwsurvey:*:*:*:*:*:*:*:* covers all versions through the disclosed ceiling of 6.14.0 with no lower-bound exception.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. As a primary compensating control, restrict access to the /api/dwsurvey/app/survey/up-survey-status.do endpoint using WAF rules or reverse-proxy ACLs to enforce role-based access at the network boundary; note this may interfere with legitimate survey management workflows and should be tested before production deployment. If DWSurvey is not required to be internet-facing, restrict the application to trusted internal networks or VPN-only access, eliminating the remote attack vector entirely. Consider suspending use of survey status-change functionality at the application or proxy layer until a patch is available. Monitor VulDB (https://vuldb.com/vuln/385634) and the diaowen project repository for any upstream fix. Organizations should also audit logs for unexpected calls to the affected endpoint to detect any prior unauthorized status changes.