CVE-2026-54103

U.S. GAO EPDS and CBCA EDS unauthenticated password change

State: Published
Severity: 9.3 Critical
Published: Jun 18, 2026
Updated: Jun 22, 2026
Reserved: Jun 11, 2026

Description

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	cisa-cg
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisa-cg

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Electronic Protest Docketing System (EPDS)Government Accountability Office	before 2026-02-22Affected 2026-02-22Not affected
Electronic Docketing System (EDS)Civilian Board of Contract Appeals	before 2026-03-19Affected 2026-03-19Not affected

References

url
urlvdb-entry
urlproduct
urlproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.