CVE-2026-54103

CRITICAL 9.8

U.S. GAO EPDS and CBCA EDS unauthenticated password change

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

CWE	CWE-306
Vendor	government accountability office
Product	electronic protest docketing system (epds)
Published	Jun 18, 2026

Stay Ahead of the Next One

Get instant alerts for government accountability office electronic protest docketing system (epds)

Be the first to know when new critical vulnerabilities affecting government accountability office electronic protest docketing system (epds) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Government Accountability Office / Electronic Protest Docketing System (EPDS)

0 < 2026-02-22

Civilian Board of Contract Appeals / Electronic Docketing System (EDS)

0 < 2026-03-19

References

NVD ↗ CVE.org ↗ EPSS Data ↗

raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json cve.org: https://www.cve.org/CVERecord?id=CVE-2026-54103 epds.gao.gov: https://epds.gao.gov/ eds.cbca.gov: https://www.eds.cbca.gov/login

Credits

Blake Rash, CISA