CVE-2026-54103
CRITICAL SEVERITYCVSS Score & Metrics
Base Score
9.8 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-306
Source
NVD
Vendor
Government Accountability Office, Civilian Board of Contract Appeals
Product
Electronic Protest Docketing System (EPDS), Electronic Docketing System (EDS)
Discussion (0)
Add Comment
No comments yet. Be the first!