What is GHSA-w9xh-mqg8-v8fv?

GHSA-w9xh-mqg8-v8fv is a security advisory published by GitHub Security Advisories with Critical severity. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...

Which CVE IDs does GHSA-w9xh-mqg8-v8fv cover?

GHSA-w9xh-mqg8-v8fv covers the following CVE IDs: CVE-2026-54103. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w9xh-mqg8-v8fv?

GHSA-w9xh-mqg8-v8fv has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-w9xh-mqg8-v8fvCriticalCVSS 9.8

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...

Vendor

GitHub Security Advisories

Published

June 18, 2026

Last Modified

June 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-54103 →

📋 Description

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-54103
https://epds.gao.gov
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json
https://www.cve.org/CVERecord?id=CVE-2026-54103
https://www.eds.cbca.gov/login
https://github.com/advisories/GHSA-w9xh-mqg8-v8fv