EUVD-2026-37910
GHSA-w9xh-mqg8-v8fv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Endpoint is internet-reachable with no auth and no user interaction (AV:N/AC:L/PR:N/UI:N); arbitrary password reset yields full account takeover, so C/I/A all High.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
7DescriptionCVE.org
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
AnalysisAI
Authentication bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals Electronic Docketing System (EDS) allows remote, unauthenticated attackers to reset arbitrary user passwords by calling the '/update-profile/N' API endpoint, which fails to verify the requester's identity. Successful exploitation results in full account takeover of any user - including potentially privileged accounts handling federal bid protests and contract appeals - with no public exploit identified at time of analysis but a CVSS 4.0 base score of 9.3 (Critical) and CISA Coordinated Disclosure tracking.
Technical ContextAI
EPDS and EDS are web-based docketing portals hosted at epds.gao.gov and eds.cbca.gov used to file and manage federal bid-protest and contract-appeal cases. The flaw maps to CWE-306 (Missing Authentication for Critical Function): the '/update-profile/N' endpoint accepts a user identifier in the URL path and processes a password-change action without verifying that the caller is authenticated as that user (or authenticated at all). This is a classic Insecure Direct Object Reference combined with missing authentication on a state-changing API, indicating the password-change handler trusts the path-supplied user ID instead of binding the operation to an authenticated session.
RemediationAI
Both systems are vendor-hosted SaaS, so remediation has already been applied server-side by the operators: EPDS was patched on 2026-02-22 and EDS was patched on 2026-03-19 per the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json - no user-side patching is required, but agencies and law firms with EPDS/EDS accounts should review account activity, force a password reset on any account that did not initiate a reset, and enable multi-factor authentication if offered. Because the flaw was server-side and is now fixed at the source, no workaround is needed today; during the exposure window the only effective compensating control would have been blocking outbound access to epds.gao.gov and eds.cbca.gov from agency networks, which would have prevented legitimate filings and was therefore not a viable mitigation.
Privilege escalation in the U.S. GAO Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals E
Insecure Direct Object Reference (IDOR) in the U.S. Government Accountability Office Electronic Protest Docketing System
Network access control bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) an
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today