CVE-2026-54105: GAO EPDS and CBCA EDS Unauthenticated Email Disclosure API Vulnerability

Technical summary

The 'update-profile/' API endpoint in both EPDS and EDS systems lacks proper access controls (CWE-639: Authorization through User-Controlled Key). Remote, unauthenticated requests can enumerate user accounts by supplying arbitrary 'user_id' parameters. The API returns a JSON response containing personally identifiable information, including email addresses associated with each account. No authentication or session token is required to trigger the disclosure.

Business impact

Parties involved in federal contract appeals—contractors, government agencies, and legal representatives—face exposure of their email addresses and associated account information in two critical dispute-resolution systems. This information can be harvested for targeted phishing campaigns, identity verification attacks, or reconnaissance prior to more sophisticated intrusions. Compromise of these systems undermines the integrity of federal procurement oversight, potentially affecting confidentiality of proprietary bid information and case details.

Affected systems

The vulnerability affects two systems operated by U.S. government agencies: (1) GAO Electronic Protest Docketing System (EPDS), and (2) Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS). Both systems are directly accessible over the public internet and handle sensitive federal contract dispute documentation. Organizations submitting protests or appeals to either system should assume their associated email addresses and account metadata are accessible to unauthenticated attackers.

Exploitability

Exploitability is straightforward. The attack requires no authentication, no special tools, and minimal technical sophistication—any attacker with network access can craft HTTP requests to the endpoint with different user_id values and harvest results. The endpoint does not rate-limit or otherwise restrict enumeration attempts. No user interaction is needed. The only barrier is knowledge that the vulnerable endpoint exists, which is minimal given that API paths are often discoverable through standard reconnaissance.

Remediation

Both EPDS and EDS must immediately implement proper authentication and authorization controls on the 'update-profile/' endpoint. Users should only be able to retrieve or modify their own account profile data, verified through session validation or cryptographic token binding. A second remediation layer should include parameter validation and rate limiting to prevent brute-force account enumeration. Affected parties should assume compromise and monitor for phishing or social engineering targeting their email addresses.

Patch guidance

Contact the GAO and CBCA directly via their official security contacts for patched versions and deployment timelines. Given the federal government context and sensitivity of these systems, patches will likely be coordinated through official government channels. Verify patch applicability and deployment status directly with your agency's IT security team or the system operator. Do not rely on third-party advisories for patch versions; confirm through official government notices.

Detection guidance

Monitor HTTP request logs for repeated or anomalous access to '/update-profile/' endpoints, particularly requests with sequential or random 'user_id' parameter values submitted by a single source IP. Alert on any successful 200-status responses to that endpoint from unauthenticated sessions or sessions lacking proper authorization tokens. Network-based detection should flag GET or POST requests to these endpoints from external IP ranges if the systems are intended for internal or VPN-authenticated use only. Consider a temporary WAF rule to block direct access to the endpoint pending patches.

Why prioritize this

Although the CVSS score of 5.3 (Medium) reflects limited direct impact, the context elevates urgency: this is a U.S. government system handling federal contract disputes, the attack requires zero authentication, and the leaked information directly enables social engineering and phishing. The reputational and operational risk to federal procurement integrity is significant. Organizations dependent on these systems should treat this as a near-term priority.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the attack vector (network-accessible, no authentication required), low complexity, and confidentiality impact (email disclosure). The score does not account for integrity or availability impact, which are absent here. Severity is Medium because the information disclosed, while sensitive, is limited to email addresses and basic account metadata rather than full personal data or financial records. However, this information serves as a beachhead for follow-on attacks, and the ease of exploitation argues for prompt remediation despite the moderate numeric score.

Frequently asked questions