CVE-2026-54105 is an authorization bypass vulnerability in the GAO EPDS and CBCA EDS systems. The vulnerability arises because the 'update-profile/' API endpoint does not properly enforce authorization checks on the 'user_id' parameter. As a result, an unauthenticated attacker can supply arbitrary user IDs and receive JSON responses containing sensitive account information, including email addresses. This exposure of sensitive data violates access control principles and could lead to privacy breaches. The vulnerability is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key). No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

An unauthenticated remote attacker can retrieve sensitive account information, including email addresses, for arbitrary users by exploiting the authorization bypass in the 'update-profile/' API endpoint. This exposure could facilitate further attacks such as phishing or social engineering but does not directly allow modification of data or system compromise. The impact is primarily information disclosure of sensitive user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint if possible, and monitor for unusual access patterns. Avoid exposing sensitive account information without proper authorization checks. Follow up with the vendor for updates on remediation.