CVE-2026-54103

9.3 criticalEPSS 0.8%

Critical (9.3). EPSS 0.8% chance of exploitation in the next 30 days.

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-06-18
Modified: 2026-06-22
Record from: the NVD, synced 2026-10-19

References

https://epds.gao.gov/
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json
https://www.cve.org/CVERecord?id=CVE-2026-54103
https://www.eds.cbca.gov/login

Check your stack JSON