Vulnerability · Published Jun 18, 2026 · Assigned by cisa-cg
CVE-2026-54103U.S. GAO EPDS and CBCA EDS unauthenticated password change
Critical 9.8
In plain English
A critical-severity missing authentication in Electronic Docketing System (EDS) from Civilian Board of Contract Appeals. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Government Accountability Office | Electronic Protest Docketing System (EPDS) | 0 – before 2026-02-22 |
| Civilian Board of Contract Appeals | Electronic Docketing System (EDS) | 0 – before 2026-03-19 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H