# CVE-2026-54104: GAO and CBCA Electronic Docketing Systems privilege escalation

Source: https://junglewise.ai/threats/cve-2026-54104-gao-and-cbca-electronic-docketing-systems-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-54104 · Severity: high · CVSS 8.8 · Published 2026-06-18

The U.S. Government Accountability Office (GAO) and the Civilian Board of Contract Appeals (CBCA) use electronic docketing systems to manage legal protests and contract appeals. A security flaw in these systems allows a registered user to gain unauthorized administrative privileges by manipulating data sent from their browser. This could allow an attacker to access sensitive legal documents, modify case records, or disrupt official government proceedings.

## Quick answers

**Is CVE-2026-54104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54104 being exploited in the wild.

**How severe is CVE-2026-54104?** High severity, with a CVSS score of 8.8, published 18 June 2026.

**Which products and versions are affected?** Civilian Board of Contract Appeals Electronic Docketing System Versions prior to 2026-03-19; Government Accountability Office Electronic Protest Docketing System Versions prior to 2026-02-22.

**Is there a fix for CVE-2026-54104?** A patch was published on 2026-02-22: GAO EPDS patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54104 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54104?** Check whether you run Civilian Board of Contract Appeals Electronic Docketing System or Government Accountability Office Electronic Protest Docketing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Client-Side Enforcement of Server-Side Security (CWE-602). The EPDS and EDS platforms fail to validate the 'epds_role_id' parameter on the server side, instead relying on values provided by the client. A remote attacker with low-privileged authenticated access can intercept and modify this parameter to assume higher-level roles. Successful exploitation results in a full compromise of confidentiality, integrity, and availability within the context of the docketing systems. Patches were released in February and March 2026 for the respective systems.

## Affected products

- Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions prior to 2026-02-22
- Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions prior to 2026-03-19

## Timeline

- 2026-02-22: patched: GAO EPDS patched
- 2026-03-19: patched: CBCA EDS patched
- 2026-06-18: disclosed: Initial NVD publication

## References

- [https://epds.gao.gov/](https://epds.gao.gov/)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json)
- [https://www.cve.org/CVERecord?id=CVE-2026-54104](https://www.cve.org/CVERecord?id=CVE-2026-54104)
- [https://www.eds.cbca.gov/login](https://www.eds.cbca.gov/login)

## Related threats

- [GAO and CBCA Docketing Systems IDOR in update-profile API](https://junglewise.ai/threats/cve-2026-54105-gao-and-cbca-docketing-systems-idor-in-update-profile-api)