Vulnerability-Lookup

VA-26-169-01

Vulnerability from csaf_cisa - Published: 2026-06-18 15:45 - Updated: 2026-06-18 15:45

Summary

U.S. GAO EPDS and CBCA EDS multiple vulnerabilities

Notes

Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Countries and Areas Deployed: Worldwide

Critical Infrastructure Sectors: Information Technology

Risk Evaluation: The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) contained multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could change all users' passwords and gain administrative privileges.

Recommended Practices: These vulnerabilities were confirmed to be fixed as of 2026-03-19.

Company Headquarters Location: United States

CVE-2026-54103

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-306 - Missing Authentication for Critical Function

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Government Accountability Office Electronic Protest Docketing System (EPDS) <2026-02-22 Government Accountability Office / Electronic Protest Docketing System (EPDS)		<2026-02-22	Vendor Fix
Civilian Board of Contract Appeals Electronic Docketing System (EDS) <2026-03-19 Civilian Board of Contract Appeals / Electronic Docketing System (EDS)		<2026-03-19	Vendor Fix

Fixed 2 products

Product	Identifier	Version	Remediation
Government Accountability Office Electronic Protest Docketing System (EPDS) 2026-02-22 Government Accountability Office / Electronic Protest Docketing System (EPDS)		2026-02-22	Vendor Fix
Civilian Board of Contract Appeals Electronic Docketing System (EDS) 2026-03-19 Civilian Board of Contract Appeals / Electronic Docketing System (EDS)		2026-03-19	Vendor Fix

CVE-2026-54104

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-602 - Client-Side Enforcement of Server-Side Security

Affected products

Known affected 2 products, the same list as for CVE-2026-54103

Fixed 2 products, the same list as for CVE-2026-54103

CVE-2026-54105

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-639 - Authorization Bypass Through User-Controlled Key

Affected products

Known affected 2 products, the same list as for CVE-2026-54103

Fixed 2 products, the same list as for CVE-2026-54103

CVE-2026-54106

4.7 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CWE-940 - Improper Verification of Source of a Communication Channel

Affected products

Known affected 2 products, the same list as for CVE-2026-54103

Fixed 2 products, the same list as for CVE-2026-54103

References

8 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://raw.githubusercontent.com/cisagov/CSAF/de…	external
https://www.cve.org/CVERecord?id=CVE-2026-54103	external
https://epds.gao.gov/	external
https://www.eds.cbca.gov/login	external
https://www.cve.org/CVERecord?id=CVE-2026-54104	external
https://www.cve.org/CVERecord?id=CVE-2026-54105	external
https://www.cve.org/CVERecord?id=CVE-2026-54106	external

Acknowledgments

CISA Blake Rash

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) contained multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could change all users\u0027 passwords and gain administrative privileges.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "These vulnerabilities were confirmed to be fixed as of 2026-03-19.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-169-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
      }
    ],
    "title": "U.S. GAO EPDS and CBCA EDS multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2026-06-18T15:45:16Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.89"
        }
      },
      "id": "VA-26-169-01",
      "initial_release_date": "2026-06-18T15:45:16Z",
      "revision_history": [
        {
          "date": "2026-06-18T15:45:16Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) \u003c2026-02-22",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) 2026-02-22",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Protest Docketing System (EPDS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) \u003c2026-02-22",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) 2026-02-22",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Protest Docketing System (EPDS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) \u003c2026-02-22",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) 2026-02-22",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Protest Docketing System (EPDS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) \u003c2026-02-22",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "2026-02-22",
                "product": {
                  "name": "Government Accountability Office Electronic Protest Docketing System (EPDS) 2026-02-22",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Protest Docketing System (EPDS)"
          }
        ],
        "category": "vendor",
        "name": "Government Accountability Office"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) \u003c2026-03-19",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) 2026-03-19",
                  "product_id": "CSAFPID-0010"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Docketing System (EDS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) \u003c2026-03-19",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) 2026-03-19",
                  "product_id": "CSAFPID-0012"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Docketing System (EDS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) \u003c2026-03-19",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version",
                "name": "2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) 2026-03-19",
                  "product_id": "CSAFPID-0014"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Docketing System (EDS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) \u003c2026-03-19",
                  "product_id": "CSAFPID-0015"
                }
              },
              {
                "category": "product_version",
                "name": "2026-03-19",
                "product": {
                  "name": "Civilian Board of Contract Appeals Electronic Docketing System (EDS) 2026-03-19",
                  "product_id": "CSAFPID-0016"
                }
              }
            ],
            "category": "product_name",
            "name": "Electronic Docketing System (EDS)"
          }
        ],
        "category": "vendor",
        "name": "Civilian Board of Contract Appeals"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Blake Rash"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-54103",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the \u0027/update-profile/N\u0027 API endpoint. A remote, unauthenticated attacker could change an arbitrary user\u0027s password.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:T/2026-06-11T16:17:36Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0010"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0009"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54103"
        },
        {
          "category": "external",
          "summary": "epds.gao.gov",
          "url": "https://epds.gao.gov/"
        },
        {
          "category": "external",
          "summary": "www.eds.cbca.gov",
          "url": "https://www.eds.cbca.gov/login"
        }
      ],
      "release_date": "2026-06-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0009"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0010"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0009"
          ]
        }
      ],
      "title": "U.S. GAO EPDS and CBCA EDS unauthenticated password change"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Blake Rash"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-54104",
      "cwe": {
        "id": "CWE-602",
        "name": "Client-Side Enforcement of Server-Side Security"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the \u0027epds_role_id\u0027 parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-06-11T16:16:59Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0010"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0009"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54104"
        },
        {
          "category": "external",
          "summary": "epds.gao.gov",
          "url": "https://epds.gao.gov/"
        },
        {
          "category": "external",
          "summary": "www.eds.cbca.gov",
          "url": "https://www.eds.cbca.gov/login"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        }
      ],
      "release_date": "2026-06-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0009"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0010"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0009"
          ]
        }
      ],
      "title": "U.S. GAO EPDS and CBCA EDS client-based privilege escalation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Blake Rash"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-54105",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the \u0027update-profile/\u0027 API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary \u0027user_id\u0027 parameter and receive a JSON response containing account-specific information, including the associated email address.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:P/2026-06-11T16:16:19Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0010"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0009"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54105"
        },
        {
          "category": "external",
          "summary": "epds.gao.gov",
          "url": "https://epds.gao.gov/"
        },
        {
          "category": "external",
          "summary": "www.eds.cbca.gov",
          "url": "https://www.eds.cbca.gov/login"
        }
      ],
      "release_date": "2026-06-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0009"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0010"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0009"
          ]
        }
      ],
      "title": "U.S. GAO EPDS and CBCA EDS user information disclosure"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Blake Rash"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-54106",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:N/T:P/2026-06-11T19:54:32Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0010"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0009"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54106"
        },
        {
          "category": "external",
          "summary": "epds.gao.gov",
          "url": "https://epds.gao.gov/"
        },
        {
          "category": "external",
          "summary": "www.eds.cbca.gov",
          "url": "https://www.eds.cbca.gov/login"
        }
      ],
      "release_date": "2026-06-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-02-22T00:00:00Z",
          "details": "Fixed on or about 2026-02-22.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0009"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-19T00:00:00Z",
          "details": "Fixed on or about 2026-03-19.",
          "product_ids": [
            "CSAFPID-0010"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0009"
          ]
        }
      ],
      "title": "U.S. GAO EPDS and CBCA EDS network access control bypass"
    }
  ]
}

CVE-2026-54103 (GCVE-0-2026-54103)

Vulnerability from cvelistv5 – Published: 2026-06-18 16:12 – Updated: 2026-06-22 12:32 Exclusively Hosted Service

Title

U.S. GAO EPDS and CBCA EDS unauthenticated password change

Summary

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-06-11 16:17 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

cisa-cg CISA root Scorecard

References

4 references

URL	Tags
https://raw.githubusercontent.com/cisagov/CSAF/de…
https://www.cve.org/CVERecord?id=CVE-2026-54103	vdb-entry
https://epds.gao.gov/	product
https://www.eds.cbca.gov/login	product

Impacted products

2 products

Vendor	Product	Version
Government Accountability Office	Electronic Protest Docketing System (EPDS)	Affected: 0 , < 2026-02-22 (custom) Unaffected: 2026-02-22
Civilian Board of Contract Appeals	Electronic Docketing System (EDS)	Affected: 0 , < 2026-03-19 (custom) Unaffected: 2026-03-19

Date Public

2026-06-18 00:00

Credits

Blake Rash, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-19T03:55:59.525967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T12:32:52.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Electronic Protest Docketing System (EPDS)",
          "vendor": "Government Accountability Office",
          "versions": [
            {
              "lessThan": "2026-02-22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-02-22"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Electronic Docketing System (EDS)",
          "vendor": "Civilian Board of Contract Appeals",
          "versions": [
            {
              "lessThan": "2026-03-19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-03-19"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Blake Rash, CISA"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the \u0027/update-profile/N\u0027 API endpoint. A remote, unauthenticated attacker could change an arbitrary user\u0027s password."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-54103",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-06-11T16:17:36.004930Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T16:12:35.433Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54103"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://epds.gao.gov/"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://www.eds.cbca.gov/login"
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "title": "U.S. GAO EPDS and CBCA EDS unauthenticated password change"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-54103",
    "datePublished": "2026-06-18T16:12:35.433Z",
    "dateReserved": "2026-06-11T19:41:26.775Z",
    "dateUpdated": "2026-06-22T12:32:52.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54104 (GCVE-0-2026-54104)

Vulnerability from cvelistv5 – Published: 2026-06-18 16:12 – Updated: 2026-06-22 12:32 Exclusively Hosted Service

Title

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

Summary

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-06-11 16:16 UTC

CWE

CWE-602 - Client-Side Enforcement of Server-Side Security

Assigner

cisa-cg CISA root Scorecard

References

4 references

URL	Tags
https://www.cve.org/CVERecord?id=CVE-2026-54104	vdb-entry
https://epds.gao.gov/	product
https://www.eds.cbca.gov/login	product
https://raw.githubusercontent.com/cisagov/CSAF/de…

Impacted products

2 products

Vendor	Product	Version
Government Accountability Office	Electronic Protest Docketing System (EPDS)	Affected: 0 , < 2026-02-22 (custom) Unaffected: 2026-02-22
Civilian Board of Contract Appeals	Electronic Docketing System (EDS)	Affected: 0 , < 2026-03-19 (custom) Unaffected: 2026-03-19

Date Public

2026-06-18 00:00

Credits

Blake Rash, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54104",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-19T03:56:02.589399Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T12:32:43.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Electronic Protest Docketing System (EPDS)",
          "vendor": "Government Accountability Office",
          "versions": [
            {
              "lessThan": "2026-02-22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-02-22"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Electronic Docketing System (EDS)",
          "vendor": "Civilian Board of Contract Appeals",
          "versions": [
            {
              "lessThan": "2026-03-19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-03-19"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Blake Rash, CISA"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the \u0027epds_role_id\u0027 parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-54104",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-06-11T16:16:59.303813Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-602",
              "description": "CWE-602 Client-Side Enforcement of Server-Side Security",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T16:12:58.699Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54104"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://epds.gao.gov/"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://www.eds.cbca.gov/login"
        },
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "title": "U.S. GAO EPDS and CBCA EDS client-based privilege escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-54104",
    "datePublished": "2026-06-18T16:12:58.699Z",
    "dateReserved": "2026-06-11T19:41:26.775Z",
    "dateUpdated": "2026-06-22T12:32:43.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54105 (GCVE-0-2026-54105)

Vulnerability from cvelistv5 – Published: 2026-06-18 16:13 – Updated: 2026-06-24 19:54 Exclusively Hosted Service

Title

U.S. GAO EPDS and CBCA EDS user information disclosure

Summary

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-06-11 16:16 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

cisa-cg CISA root Scorecard

References

4 references

URL	Tags
https://raw.githubusercontent.com/cisagov/CSAF/de…
https://www.cve.org/CVERecord?id=CVE-2026-54105	vdb-entry
https://epds.gao.gov/	product
https://www.eds.cbca.gov/login	product

Impacted products

2 products

Vendor	Product	Version
Government Accountability Office	Electronic Protest Docketing System (EPDS)	Affected: 0 , < 2026-02-22 (custom) Unaffected: 2026-02-22
Civilian Board of Contract Appeals	Electronic Docketing System (EDS)	Affected: 0 , < 2026-03-19 (custom) Unaffected: 2026-03-19

Date Public

2026-06-18 00:00

Credits

Blake Rash, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54105",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T19:53:57.662222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T19:54:05.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Electronic Protest Docketing System (EPDS)",
          "vendor": "Government Accountability Office",
          "versions": [
            {
              "lessThan": "2026-02-22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-02-22"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Electronic Docketing System (EDS)",
          "vendor": "Civilian Board of Contract Appeals",
          "versions": [
            {
              "lessThan": "2026-03-19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-03-19"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Blake Rash, CISA"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the \u0027update-profile/\u0027 API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary \u0027user_id\u0027 parameter and receive a JSON response containing account-specific information, including the associated email address."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-54105",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-06-11T16:16:19.191886Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T16:13:24.123Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54105"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://epds.gao.gov/"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://www.eds.cbca.gov/login"
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "title": "U.S. GAO EPDS and CBCA EDS user information disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-54105",
    "datePublished": "2026-06-18T16:13:24.123Z",
    "dateReserved": "2026-06-11T19:41:26.775Z",
    "dateUpdated": "2026-06-24T19:54:05.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54106 (GCVE-0-2026-54106)

Vulnerability from cvelistv5 – Published: 2026-06-18 16:13 – Updated: 2026-06-24 19:52 Exclusively Hosted Service

Title

U.S. GAO EPDS and CBCA EDS network access control bypass

Summary

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-06-11 19:54 UTC

CWE

CWE-940 - Improper Verification of Source of a Communication Channel

Assigner

cisa-cg CISA root Scorecard

References

4 references

URL	Tags
https://raw.githubusercontent.com/cisagov/CSAF/de…
https://www.cve.org/CVERecord?id=CVE-2026-54106	vdb-entry
https://epds.gao.gov/	product
https://www.eds.cbca.gov/login	product

Impacted products

2 products

Vendor	Product	Version
Government Accountability Office	Electronic Protest Docketing System (EPDS)	Affected: 0 , < 2026-02-22 (custom) Unaffected: 2026-02-22
Civilian Board of Contract Appeals	Electronic Docketing System (EDS)	Affected: 0 , < 2026-03-19 (custom) Unaffected: 2026-03-19

Date Public

2026-06-18 00:00

Credits

Blake Rash, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54106",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T19:52:03.881548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T19:52:10.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Electronic Protest Docketing System (EPDS)",
          "vendor": "Government Accountability Office",
          "versions": [
            {
              "lessThan": "2026-02-22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-02-22"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Electronic Docketing System (EDS)",
          "vendor": "Civilian Board of Contract Appeals",
          "versions": [
            {
              "lessThan": "2026-03-19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026-03-19"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Blake Rash, CISA"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-54106",
              "options": [
                {
                  "Exploitation": "poc"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-06-11T19:54:32.618326Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940 Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T16:13:47.351Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54106"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://epds.gao.gov/"
        },
        {
          "name": "url",
          "tags": [
            "product"
          ],
          "url": "https://www.eds.cbca.gov/login"
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "title": "U.S. GAO EPDS and CBCA EDS network access control bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-54106",
    "datePublished": "2026-06-18T16:13:47.351Z",
    "dateReserved": "2026-06-11T19:41:26.775Z",
    "dateUpdated": "2026-06-24T19:52:10.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

VA-26-169-01

CVE-2026-54103 (GCVE-0-2026-54103)

CVE-2026-54104 (GCVE-0-2026-54104)

CVE-2026-54105 (GCVE-0-2026-54105)

CVE-2026-54106 (GCVE-0-2026-54106)

Tags

Sightings

Nomenclature

Related by attack behaviour