Sensitive Information Exposure in GAO Electronic Docketing Systems

CVE-2026-54105

What is CVE-2026-54105?

The GAO Electronic Protest Docketing System and the Civilian Board of Contract Appeals Electronic Docketing System are vulnerable to information exposure via their 'update-profile/' API endpoint. This flaw allows a remote, unauthenticated attacker to exploit an arbitrary 'user_id' parameter, resulting in the unauthorized retrieval of sensitive account details, including user email addresses. This vulnerability underscores the importance of robust access controls and input validation to safeguard against potential data breaches.

References