TI-2026-39030 Aliases CVE-2026-54105 GHSA-79rr-2p25-73c5

U.S. GAO EPDS and CBCA EDS user information disclosure

LOW 37CWE-639Published 2026-06-18 · Updated 2026-06-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00505 43rd percentileScored 2026-11-07

Fix Fixed Electronic Protest Docketing System (EPDS) (Government Accountability Office): 2026-02-22Electronic Docketing System (EDS) (Civilian Board of Contract Appeals): 2026-03-19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Government Accountability Office	Electronic Protest Docketing System (EPDS)	before 2026-02-22	2026-02-22	Patch available	CNA
Civilian Board of Contract Appeals	Electronic Docketing System (EDS)	before 2026-03-19	2026-03-19	Patch available	CNA

Electronic Protest Docketing System (EPDS) VendorGovernment Accountability Office Affected before 2026-02-22 Fixed in 2026-02-22 Patch available CNA
Electronic Docketing System (EDS) VendorCivilian Board of Contract Appeals Affected before 2026-03-19 Fixed in 2026-03-19 Patch available CNA

Remediation

Fix · CNA Electronic Protest Docketing System (EPDS) (Government Accountability Office) Fixed in 2026-02-22
Fix · CNA Electronic Docketing System (EDS) (Civilian Board of Contract Appeals) Fixed in 2026-03-19

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-18
Government Accountability Office Electronic Protest Docketing System (EPDS) 2026-02-22
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-39031 U.S. GAO EPDS and CBCA EDS network access control bypassPriority MEDIUM 56
- TI-2026-39028 U.S. GAO EPDS and CBCA EDS unauthenticated password changePriority MEDIUM 49
- TI-2026-39029 U.S. GAO EPDS and CBCA EDS client-based privilege escalationPriority MEDIUM 41
Show all 4 records →
Release · 2026-06-18
Civilian Board of Contract Appeals Electronic Docketing System (EDS) 2026-03-19
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-39031 U.S. GAO EPDS and CBCA EDS network access control bypassPriority MEDIUM 56
- TI-2026-39028 U.S. GAO EPDS and CBCA EDS unauthenticated password changePriority MEDIUM 49
- TI-2026-39029 U.S. GAO EPDS and CBCA EDS client-based privilege escalationPriority MEDIUM 41
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-54105
2026-10-03 Alias added: GHSA-79rr-2p25-73c5

References

Other 4

TI-2026-39031 U.S. GAO EPDS and CBCA EDS network access control bypass CVSS 4.0MEDIUM 5.1
TI-2026-39028 U.S. GAO EPDS and CBCA EDS unauthenticated password change CVSS 4.0CRITICAL 9.3
TI-2026-39029 U.S. GAO EPDS and CBCA EDS client-based privilege escalation CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences