Description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Government Accountability Office | Electronic Protest Docketing System (EPDS) | < 2026-02-22 | 2026-02-22 |
| Civilian Board of Contract Appeals | Electronic Docketing System (EDS) | < 2026-03-19 | 2026-03-19 |
Advisories 1
- VA-26-169-01 U.S. GAO EPDS and CBCA EDS multiple vulnerabilities CISA ICS & IT advisories · Jun 18, 2026