Government Accountability Office vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Government Accountability Office products: 4 record(s), with severity, exploitation and fixes.

Electronic Protest Docketing System (EPDS) 4

Exploited only (KEV) →

CVE-2026-54106 Medium · 4.7 CWE-940 Jun 18, 2026

U.S. GAO EPDS and CBCA EDS network access control bypass

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.

CVE-2026-54105 Medium · 5.3 CWE-639 Jun 18, 2026

U.S. GAO EPDS and CBCA EDS user information disclosure

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.

CVE-2026-54104 High · 8.8 CWE-602 Jun 18, 2026

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.

CVE-2026-54103 Critical · 9.8 CWE-306 Jun 18, 2026

GAO EPDS and CBCA EDS: Missing Authentication on Password Change Endpoint

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.