CVE-2026-54104highCWE-602

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.7%

probabilidad de explotación

0.7%top 49% de las CVE

explotación observada

noninguna fuente lo reporta

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Civilian Board of Contract Appeals · Electronic Docketing System (EDS)Government Accountability Office · Electronic Protest Docketing System (EPDS)

Referencias

https://epds.gao.gov/https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json https://www.cve.org/CVERecord?id=CVE-2026-54104 https://www.eds.cbca.gov/login