The vulnerability identified as CVE-2026-54104 affects the GAO EPDS and CBCA EDS by improperly trusting the 'epds_role_id' parameter supplied by clients. Because the systems do not verify this parameter server-side, an authenticated attacker can manipulate it to escalate privileges beyond their authorized level. This is a classic example of CWE-602, where client-side enforcement of security controls leads to privilege escalation. The CVSS v3.1 base score is 8.8, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

An attacker with valid authentication can escalate their privileges by manipulating the 'epds_role_id' parameter, potentially gaining unauthorized access to sensitive functions or data within the EPDS and EDS systems. This compromises confidentiality, integrity, and availability of the affected systems, posing a significant risk to the security of government protest and docketing processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing server-side validation of all client-supplied parameters, especially those controlling access rights, to prevent privilege escalation. Monitoring for unusual privilege changes and restricting access to trusted users may reduce risk temporarily.