Log in Start free

Vulnerability · Published Jun 18, 2026 · Assigned by cisa-cg

CVE-2026-54104U.S. GAO EPDS and CBCA EDS client-based privilege escalation

High 8.8

In plain English

A high-severity security flaw in Electronic Docketing System (EDS) from Civilian Board of Contract Appeals. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.

Affected products (as reported)

VendorProductVersions
Government Accountability Office Electronic Protest Docketing System (EPDS) 0 – before 2026-02-22
Civilian Board of Contract Appeals Electronic Docketing System (EDS) 0 – before 2026-03-19

Weakness: CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References