CVE-2026-54105
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
5.3 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-639
Source
NVD
Vendor
Government Accountability Office, Civilian Board of Contract Appeals
Product
Electronic Protest Docketing System (EPDS), Electronic Docketing System (EDS)
Discussion (0)
Add Comment
No comments yet. Be the first!