PatchSiren cyber security CVE debrief

CVE-2026-54103 U.S. Government Accountability Office (GAO) CVE debrief

CVE-2026-54103 is a critical vulnerability in the U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS). The system fails to authenticate password change requests to the '/update-profile/N' API endpoint, allowing a remote, unauthenticated attacker to change an arbitrary user's password. This vulnerability has a CVSS score of 9.3 and is considered critical. The vulnerability was published on June 18, 2026, and last modified on the same day.

Vendor: U.S. Government Accountability Office (GAO)
Product: Electronic Protest Docketing System (EPDS)
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-18
Original CVE updated: 2026-06-18
Advisory published: 2026-06-18
Advisory updated: 2026-06-18

Who should care

Organizations using the GAO EPDS and CBCA EDS systems should prioritize patching this vulnerability to prevent unauthorized access. Additionally, security teams and administrators responsible for these systems should be aware of the potential risks and take immediate action to mitigate the vulnerability.

Technical summary

The vulnerability exists in the '/update-profile/N' API endpoint of the GAO EPDS and CBCA EDS systems. An unauthenticated attacker can exploit this vulnerability to change the password of any user, potentially leading to unauthorized access to sensitive information. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

high

Recommended defensive actions

Apply patches or updates provided by the vendor to fix the vulnerability
Implement additional authentication mechanisms for password change requests
Monitor the system for suspicious activity and implement logging and auditing
Restrict access to the '/update-profile/N' API endpoint
Use secure communication protocols (e.g., HTTPS) to encrypt data in transit
Consider implementing a Web Application Firewall (WAF) to detect and prevent attacks
Conduct regular security assessments and penetration testing to identify vulnerabilities

Evidence notes

The information provided is based on the NVD modified source item and CVE record. The vulnerability details and CVSS vector are sourced from the NVD and CVE.org. The affected systems and CVSS score are confirmed by the CVE record and NVD detail pages.

Sources and references

Verified primary and authoritative sources

CVE-2026-54103 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-54103

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-54103 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54103

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://epds.gao.gov/

9119a7d8-5eab-497f-8521-727c672e3725
Source reference
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json

9119a7d8-5eab-497f-8521-727c672e3725
Source reference
Unverified legacy reference

URL: https://www.eds.cbca.gov/login

9119a7d8-5eab-497f-8521-727c672e3725

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.