Is CVE-2026-54105 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54105 being exploited in the wild.

How severe is CVE-2026-54105?

Medium severity, with a CVSS score of 5.3, published 18 June 2026.

Which products and versions are affected?

Civilian Board of Contract Appeals Electronic Docketing System Versions prior to 2026-03-19; Government Accountability Office Electronic Protest Docketing System Versions prior to 2026-02-22.

Is there a fix for CVE-2026-54105?

A patch was published on 2026-02-22: GAO EPDS patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54105 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-54105?

Check whether you run Civilian Board of Contract Appeals Electronic Docketing System or Government Accountability Office Electronic Protest Docketing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54105: GAO and CBCA Docketing Systems IDOR in update-profile API

CVE-2026-54105 · Severity: medium · CVSS 5.3 · Published 2026-06-18

The U.S. Government Accountability Office (GAO) and the Civilian Board of Contract Appeals (CBCA) operate digital systems for managing legal protests and contract appeals. A security flaw in these systems allowed unauthorized individuals to access sensitive account details, such as user email addresses, by manipulating web requests. This could lead to the exposure of private contact information for government contractors and legal professionals using the platforms.

Quick answers

Is CVE-2026-54105 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54105 being exploited in the wild.
How severe is CVE-2026-54105?: Medium severity, with a CVSS score of 5.3, published 18 June 2026.
Which products and versions are affected?: Civilian Board of Contract Appeals Electronic Docketing System Versions prior to 2026-03-19; Government Accountability Office Electronic Protest Docketing System Versions prior to 2026-02-22.
Is there a fix for CVE-2026-54105?: A patch was published on 2026-02-22: GAO EPDS patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54105 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54105?: Check whether you run Civilian Board of Contract Appeals Electronic Docketing System or Government Accountability Office Electronic Protest Docketing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) or Authorization Bypass Through User-Controlled Key (CWE-639) within the 'update-profile/' API endpoint. By supplying an arbitrary 'user_id' parameter in a network request, a remote, unauthenticated attacker can bypass authorization checks to retrieve JSON responses containing sensitive user data, specifically email addresses. The flaw stems from a failure to validate that the requesting user has the permission to view the profile associated with the provided ID. Patches were reportedly implemented in February and March 2026 for the respective systems.

Affected products

Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions prior to 2026-02-22
Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions prior to 2026-03-19

Timeline

2026-02-22: patched: GAO EPDS patched
2026-03-19: patched: CBCA EDS patched
2026-06-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.