Description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Government Accountability Office | Electronic Protest Docketing System (EPDS) | < 2026-02-22 | 2026-02-22 |
| Civilian Board of Contract Appeals | Electronic Docketing System (EDS) | < 2026-03-19 | 2026-03-19 |
Advisories 1
- VA-26-169-01 U.S. GAO EPDS and CBCA EDS multiple vulnerabilities CISA ICS & IT advisories · Jun 18, 2026