Description (CNA)
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Government Accountability Office / Electronic Protest Docketing System (EPDS) | affected 0 before 2026-02-22; unaffected 2026-02-22 |
| Civilian Board of Contract Appeals / Electronic Docketing System (EDS) | affected 0 before 2026-03-19; unaffected 2026-03-19 |
CWE
CWE-306
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-54103
- https://epds.gao.gov/
- https://www.eds.cbca.gov/login
ADP enrichment
No English description supplied.
No references supplied.