by Kastro
Paper/Archive/CVE-2026-54103

CVE-2026-54103

Government Accountability Office Electronic Protest Docketing System (EPDS) — U.S. GAO EPDS and CBCA EDS unauthenticated password change

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.7.557 × 2011.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

Affected

ProductAffectedFixed inSource
Electronic Protest Docketing System (EPDS)< 2026-02-222026-02-22CNA
Electronic Docketing System (EDS)< 2026-03-192026-03-19CNA

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa-cg (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.jsonrefcve.org/CVERecord?id=CVE-2026-54103refepds.gao.govrefeds.cbca.gov/login