CVE-2026-54105 — U.S. GAO EPDS and CBCA EDS user information disclosure
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose…
Published: 2026-06-18 · CVSS: 6.9 · CVSS 4.0
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7