CVE-2026-54105

U.S. GAO EPDS and CBCA EDS user information disclosure

Published Jun 18, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.

Analysis

Technical impact

A remote attacker can submit an arbitrary user_id to the update-profile/ API endpoint without authentication and obtain JSON data that includes sensitive account information, notably the associated email address. The weakness is a classic evidence of lack of proper access control, mapping to CWE-639.

Affected Systems

The vulnerability affects the U.S. Government Accountability Office’s Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals’ Electronic Docketing System (EDS). Both systems host the exposed API endpoint that returns user‑specific data.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity with full confidentiality impact. No EPSS score is reported, and the vulnerability is not listed in CISA KEV, so immediate exploitation risk is unclear. Nonetheless, any attacker can obtain personal email addresses from the systems, potentially facilitating phishing or other credential‑guessing attacks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Government Accountability Office

Electronic Protest Docketing System (EPDS)

unknown

Version	Status	Constraints
`0`	affected	< 2026-02-22
`2026-02-22`	unaffected	—

Civilian Board of Contract Appeals

Electronic Docketing System (EDS)

affected

Version	Status	Constraints
`0`	affected	< 2026-03-19
`2026-03-19`	unaffected	—

No data.

Vendor Product Versions

Civilian Board Of Contract Appeals

Electronic Docketing System (eds)

Version	Status	Scheme	Platform
`[0,2026-03-19)`	affected	generic	—
`2026-03-19`	unaffected	generic	—

Government Accountability Office

Electronic Protest Docketing System (epds)

Version	Status	Scheme	Platform
`[0,2026-02-22)`	affected	generic	—
`2026-02-22`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest security patch issued by GAO or CBCA for the EPDS and EDS update‑profile endpoint.
Configure the API to require authentication before it accepts request parameters, ensuring only authorized users can query profile data.
Restrict access to the update‑profile/ endpoint by IP or request header, and implement input validation to reject arbitrary user_id values.

Generated by OpenCVE AI on June 18, 2026 at 19:00 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.505% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://epds.gao.gov/
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json
https://www.cve.org/CVERecord?id=CVE-2026-54105
https://www.eds.cbca.gov/login

History

Jun 24, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 21, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Civilian Board Of Contract Appeals Civilian Board Of Contract Appeals electronic Docketing System (eds) Government Accountability Office Government Accountability Office electronic Protest Docketing System (epds)
Vendors & Products		Civilian Board Of Contract Appeals Civilian Board Of Contract Appeals electronic Docketing System (eds) Government Accountability Office Government Accountability Office electronic Protest Docketing System (epds)

Jun 18, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.
Title		U.S. GAO EPDS and CBCA EDS user information disclosure
Weaknesses		CWE-639
References		https://epds.gao.gov/ https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json https://www.cve.org/CVERecord?id=CVE-2026-54105 https://www.eds.cbca.gov/login
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`