CVE-2026-54103 — U.S. GAO EPDS and CBCA EDS unauthenticated password change
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does n…
Published: 2026-06-18 · CVSS: 9.3 · CVSS 4.0
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7