CVE-2026-54105

U.S. GAO EPDS and CBCA EDS user information disclosure

State: Published
Severity: 6.9 Medium
Published: Jun 18, 2026
Updated: Jun 24, 2026
Reserved: Jun 11, 2026

Description

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	cisa-cg
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	cisa-cg

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Electronic Protest Docketing System (EPDS)Government Accountability Office	before 2026-02-22Affected 2026-02-22Not affected
Electronic Docketing System (EDS)Civilian Board of Contract Appeals	before 2026-03-19Affected 2026-03-19Not affected

References

url
urlvdb-entry
urlproduct
urlproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.