EUVD-2026-57768
GHSA-6jj4-v58m-mhvw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-accessible authentication bypass with no privileges or interaction needed; high confidentiality exposure of ERP data, limited integrity, no availability impact.
Primary rating from Vendor (INCD).
CVSS VectorVendor: INCD
Lifecycle Timeline
2DescriptionCVE.org
CWE-284: Improper Access Control
AnalysisAI
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Portal Generator Addon for Priority ERP must be installed, enabled, and network-accessible - either internet-facing or reachable from an attacker-controlled network position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N presents several compounding risk factors: network accessibility with no authentication requirement and low attack complexity collectively indicate a straightforward, automatable attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the INCD advisory at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 for official guidance; no specific patched version number was confirmed in the available input data, and a patch version cannot be independently cited without vendor release information. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Priority ERP instances running the Portal Generator Addon and assess network accessibility; immediately restrict Portal Generator portal endpoints to internal-only access via trusted IP ranges and disable any public internet routing to these URLs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. Rate
Priority Windows may allow Command Execution via SQL Injection using an unspecified method. Rated critical severity (CVS
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauth
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solu
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allo
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Soluti
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solution
Priority - CWE-552: Files or Directories Accessible to External Parties. Rated high severity (CVSS 7.5), this vulnerabil
Priority - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Rated high severity (CVSS 7.5), this vul
this vulnerability affect user that even not allowed to access via the web interface. Rated medium severity (CVSS 6.3),
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today