The vulnerability identified as CVE-2026-54105 (CWE-639) affects the GAO's EPDS and CBCA's EDS. The issue arises from improper authorization checks on the 'update-profile/' API endpoint, which accepts a user-controlled 'user_id' parameter. An attacker can exploit this by sending requests with arbitrary user_id values without authentication, causing the system to disclose account-specific information such as associated email addresses in the response. This represents an authorization bypass vulnerability that leaks sensitive user data.

An unauthenticated remote attacker can retrieve sensitive account information, including email addresses, of arbitrary users by exploiting the authorization bypass in the 'update-profile/' API endpoint. This exposure could facilitate further targeted attacks such as phishing or social engineering. However, there is no indication of direct system compromise or data modification from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Until a fix is available, restrict access to the affected API endpoint if possible and monitor for suspicious activity related to unauthorized data access attempts.