EUVD-2026-37912
GHSA-79rr-2p25-73c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint discloses only low-sensitivity account metadata (email); no integrity or availability impact applies.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
3DescriptionCVE.org
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals Electronic Docketing System (EDS) permits remote unauthenticated attackers to harvest account-specific information from any registered user. By supplying an arbitrary 'user_id' value to the publicly exposed 'update-profile/' API endpoint, an attacker receives a JSON payload disclosing the target account's email address and associated metadata without any credential requirement. No public exploit code or CISA KEV listing exists at time of analysis, but the trivially low attack complexity - no authentication, no interaction, no special configuration - makes automated mass enumeration of the user base a realistic and immediate concern for agencies relying on these procurement dispute systems.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) describes a failure to enforce access control on operations that are keyed by a user-supplied identifier rather than the server-side session identity of the authenticated caller. In this case, the 'update-profile/' REST API endpoint on both GAO EPDS (cpe:2.3:a:government_accountability_office:electronic_protest_docketing_system_(epds):*) and CBCA EDS (cpe:2.3:a:civilian_board_of_contract_appeals:electronic_docketing_system_(eds):*) accepts a 'user_id' parameter without validating that the requester is the account owner or holds administrative privilege. The server resolves the supplied identifier directly against the user store and returns the corresponding profile as a JSON object. The wildcard version specifier in both CPE strings indicates all known versions are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is internet-reachable, requires no configuration pre-requisite, and is callable by anonymous actors. A 'Microsoft' tag appears in the intelligence metadata, which may reflect the underlying technology stack (e.g., ASP.NET or Azure hosting) but is not confirmed by the advisory reference and should not be treated as authoritative.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis; the affected version range in both CPE strings uses a wildcard. The primary fix requires the owning agencies (GAO and CBCA) to enforce server-side authorization on the 'update-profile/' endpoint by verifying that the 'user_id' in the request matches the session-bound identity of the authenticated caller before returning any profile data - or, if the endpoint must remain partially public, stripping all account-identifying fields from the unauthenticated response. As a compensating control prior to patching, agencies should restrict public network access to the 'update-profile/' API path via WAF rules or API gateway policy, limiting calls to authenticated sessions only; this eliminates unauthenticated enumeration at the cost of requiring session enforcement at the perimeter rather than in application logic. Rate limiting on the endpoint (e.g., 10 requests per IP per minute) would significantly slow enumeration but would not prevent a determined attacker with distributed infrastructure. The CISA advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json should be monitored for patch availability updates.
Authentication bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) and the Ci
Privilege escalation in the U.S. GAO Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals E
Network access control bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) an
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today