EPDS and EDS CVE-2026-54104

Attacker must hold a valid authenticated account on either https://epds.gao.gov/ (EPDS) or https://www.eds.cbca.gov/login (EDS) - the CVSS PR:L confirms low-privilege authentication is required - and must be able to send an HTTP request that includes the 'epds_role_id' parameter. No user interaction by another party is required (UI:N), no special attack requirements apply (AT:N), and exploitation is possible against the default configuration of the affected systems prior to the GAO fix of 2026-02-22 and the CBCA fix of 2026-03-19. The principal limiting factor is account provisioning: these are federal docketing portals with vetted user populations (contractors, attorneys, agency personnel), so an attacker must first obtain or compromise such an account.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC/VI/VA all High reflects a network-reachable, low-complexity flaw exploitable by any authenticated user with no interaction, producing full confidentiality, integrity, and availability impact on docketing data - protest filings, sealed exhibits, and adjudication records. There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so the realistic threat is targeted abuse by legitimate filers (attorneys, contractors, agency personnel) rather than mass exploitation, but the bar to weaponize is trivial: change one parameter. Because both systems are operated by the federal government and the fixes appear to have been deployed server-side rather than as a downloadable patch, the residual risk to end users is low once the production date passes, but historical exposure (data accessed before the fix) cannot be assessed from public data.

A registered EPDS or EDS user - for example, an attorney with a low-privilege filer account - logs in normally, then intercepts an authenticated request with a web proxy and modifies the 'epds_role_id' value to that of an administrator or adjudicator role. The server honors the substituted identifier without checking it against the session, granting the attacker access to other parties' protest filings, sealed exhibits, and administrative functions; no public exploit is identified at time of analysis but the technique is trivial enough to be reproduced from the advisory alone.