EUVD-2026-37911
GHSA-768x-r5g5-79vc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web app, trivial parameter tampering, requires any authenticated account (PR:L), no user interaction, full impact on docketing data confidentiality, integrity, and availability.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
7DescriptionCVE.org
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.
AnalysisAI
Privilege escalation in the U.S. GAO Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals Electronic Docketing System (EDS) allows authenticated remote attackers to elevate their privileges by tampering with the client-supplied 'epds_role_id' parameter, which the server accepts without verification. Reported by CISA-CG and tracked as EUVD-2026-37911 with a CVSS 4.0 score of 8.7, no public exploit identified at time of analysis. Both web applications have been patched by their respective government operators.
Technical ContextAI
EPDS is the GAO's web portal for filing and tracking bid protests, and EDS is the CBCA's analogous docketing system for civilian agency contract appeals; both apparently share code and a common role-identifier scheme. The root cause is CWE-602 (Client-Side Enforcement of Server-Side Security): the server reads 'epds_role_id' from a client-controlled location (form field, cookie, or hidden parameter) and uses it for authorization decisions without re-checking the value against the authenticated session. Because role assignment is treated as client state rather than being looked up server-side from the authenticated user record, any logged-in user can substitute a higher-privileged role identifier and have it honored.
RemediationAI
Patch available per vendor advisory: GAO deployed the EPDS fix on 2026-02-22 and CBCA deployed the EDS fix on 2026-03-19, both applied server-side to the hosted services, so users do not need to take direct action beyond confirming they are accessing the live production sites at https://epds.gao.gov/ and https://www.eds.cbca.gov/login. Organizations that integrate with these portals should review the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json and audit their own filing/access logs from before the respective fix dates for anomalous role transitions or access to records outside the user's authorized scope. As a compensating control during the pre-patch window, operators should have moved role lookup entirely server-side keyed on the session principal, ignored any client-supplied 'epds_role_id', and logged occurrences of that parameter being supplied - the side effect is potentially breaking any legitimate workflows that relied on switching roles via the parameter, which should instead be implemented as an authenticated server-side role-switch endpoint.
Authentication bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) and the Ci
Insecure Direct Object Reference (IDOR) in the U.S. Government Accountability Office Electronic Protest Docketing System
Network access control bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) an
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today