VULNERABILITY INTELLIGENCE
CVE-2026-54103
CVSS score9.8 CRITICAL
EPSS probability0.77%
CISA KEVNot currently listed
Published2026-06-18
Last modified2026-06-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Weakness classification
- 9119a7d8-5eab-497f-8521-727c672e3725: CWE-306