This vulnerability in diaowen DWSurvey up to version 6.14.0 allows an attacker to bypass authorization controls in the Survey Status Handler component via the /api/dwsurvey/app/survey/up-survey-status.do endpoint. The exact function affected is unknown. The flaw permits remote exploitation without requiring user interaction and has been publicly disclosed. No official remediation or patch has been provided by the vendor as of the publication date.

An attacker with low privileges can remotely exploit this vulnerability to perform unauthorized actions related to survey status handling. The impact is limited by the requirement of some privileges (PR:L) and the vulnerability's low to limited scope and impact metrics, resulting in a medium severity rating. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for official updates. Until a patch is available, restrict access to the affected API endpoint where possible and apply compensating controls to limit unauthorized access.