PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54103 U.S. Government Accountability Office (GAO) CVE debrief

CVE-2026-54103 is a critical vulnerability in the U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS). The system fails to authenticate password change requests to the '/update-profile/N' API endpoint, allowing a remote, unauthenticated attacker to change an arbitrary user's password. This vulnerability has a CVSS score of 9.3 and is considered critical. The vulnerability was published on June 18, 2026, and last modified on the same day.

Vendor
U.S. Government Accountability Office (GAO)
Product
Electronic Protest Docketing System (EPDS)
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-22
Advisory published
2026-06-18
Advisory updated
2026-06-22

Who should care

Organizations using the GAO EPDS and CBCA EDS systems should prioritize patching this vulnerability to prevent unauthorized access. Additionally, security teams and administrators responsible for these systems should be aware of the potential risks and take immediate action to mitigate the vulnerability.

Technical summary

The vulnerability exists in the '/update-profile/N' API endpoint of the GAO EPDS and CBCA EDS systems. An unauthenticated attacker can exploit this vulnerability to change the password of any user, potentially leading to unauthorized access to sensitive information. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

high

Recommended defensive actions

  • Apply patches or updates provided by the vendor to fix the vulnerability
  • Implement additional authentication mechanisms for password change requests
  • Monitor the system for suspicious activity and implement logging and auditing
  • Restrict access to the '/update-profile/N' API endpoint
  • Use secure communication protocols (e.g., HTTPS) to encrypt data in transit
  • Consider implementing a Web Application Firewall (WAF) to detect and prevent attacks
  • Conduct regular security assessments and penetration testing to identify vulnerabilities

Evidence notes

The information provided is based on the NVD modified source item and CVE record. The vulnerability details and CVSS vector are sourced from the NVD and CVE.org. The affected systems and CVSS score are confirmed by the CVE record and NVD detail pages.

Official resources

This debrief is based on publicly available information and is intended for general informational purposes only.