Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-54104

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Government Accountability Office Electronic Protest Docketing System (EPDS)

Default version status: unknown

  • 0 to < 2026-02-22affected
  • 2026-02-22unaffected

Civilian Board of Contract Appeals Electronic Docketing System (EDS)

Default version status: affected

  • 0 to < 2026-03-19affected
  • 2026-03-19unaffected

References