CVE-2026-54105

Περιγραφή

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the -update-profile/- API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary -user_id- parameter and receive a JSON response containing account-specific information, including the associated email address.