GAO EPDS EUVD-2026-37912

No special conditions are required for exploitation against both GAO EPDS and CBCA EDS. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote unauthenticated exploitation against the default internet-accessible deployment. The sole requirement is network reachability to the 'update-profile/' API endpoint and knowledge of the endpoint path. Exploitation is limited by the narrow impact ceiling - only account metadata (email addresses) is disclosed per the description; no credentials, documents, or protest-case content are confirmed to be exposed through this specific endpoint. Sequential or guessable integer user identifiers would accelerate enumeration, but the vulnerability is not predicated on their structure. No specific platform, feature flag, or non-default configuration is required.

The CVSS 4.0 base score of 6.9 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N places this as a medium-severity finding by score alone, but the practical risk is disproportionately higher for the affected user population. The VC:L impact reflects that only limited data (email addresses, account metadata) is exposed per query, not high-value secrets such as credentials or financial records; however, the combination of PR:N (no authentication) and AC:L (no complexity) means an attacker can enumerate the full user registry in minutes with trivial scripting. Both systems serve government contracting officials, legal representatives, and procurement professionals involved in bid protests - a targeted adversary could use harvested emails for spear-phishing, pre-texting, or competitive intelligence in active protest proceedings. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. No public proof-of-concept has been identified. SSVC signals point toward 'Act' urgency: the exploitation is automatable (no barriers), technical impact is partial (data disclosure without system compromise), and the affected systems are U.S. government infrastructure with defined mission-criticality. The absence of integrity or availability impact keeps the ceiling low, but the account-enumeration surface and sensitivity of the user community elevate real-world priority above the raw score.

An unauthenticated attacker writes a simple script that iterates integer values for the 'user_id' parameter in HTTP requests to the 'update-profile/' endpoint of epds.gao.gov or eds.cbca.gov, collecting the JSON response for each valid identifier. Within minutes, the attacker assembles a full directory of registered user email addresses, which can then be used to launch targeted phishing campaigns impersonating GAO or CBCA communications to attorneys and contracting officers involved in active bid protests. No public proof-of-concept has been identified, but the attack requires only basic HTTP tooling and no prior access.