Vulnerability · Published Jun 18, 2026 · Assigned by cisa-cg
CVE-2026-54105U.S. GAO EPDS and CBCA EDS user information disclosure
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in Electronic Docketing System (EDS) from Civilian Board of Contract Appeals. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Government Accountability Office | Electronic Protest Docketing System (EPDS) | 0 – before 2026-02-22 |
| Civilian Board of Contract Appeals | Electronic Docketing System (EDS) | 0 – before 2026-03-19 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N