Portal Generator Addon CVE-2026-59503

Exploitation requires only that an instance of the Portal Generator Addon to Priority ERP be network-reachable by the attacker; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special access, and no user interaction against a reachable portal. The primary limiting factor is exposure and deployment scope: the vulnerable component is a specific third-party addon (Soft Solutions) to Priority ERP rather than the core ERP, and it must be deployed and internet- or attacker-network-accessible. Instances kept internal-only, behind VPN/IP allowlists, or where the portal generator addon is not installed are not remotely exploitable. The exact vulnerable endpoint/parameter is not specified in the available data, which is a practical prerequisite an attacker must first identify.

The signals are partially conflicting and should be read carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1) describes trivial remote, unauthenticated, low-complexity exploitation with High confidentiality impact - consistent with a serious data-exposure bug. However, the assigned CWEs (CWE-200/CWE-359) describe pure information disclosure, yet the vector also asserts I:H (High integrity impact), which is inconsistent with a read-only exposure flaw; this discrepancy should be verified with the vendor/INCD, as the true integrity impact may be N (which would lower the score). No EPSS score, KEV listing, or SSVC decision data was provided, so real-world exploitation probability cannot be quantified from the input. There is no KEV entry and no POC reference, so this is not confirmed as actively exploited. Net: the confidentiality risk is credible and high-severity for exposed instances, but the elevated 9.1 rests partly on a questionable I:H metric, and the niche, region-specific product footprint likely limits mass exploitation versus targeted attacks.

A remote attacker with no credentials sends crafted requests to an internet-exposed Priority ERP portal generated by the addon and receives sensitive personal or business records in the responses, without triggering any authentication prompt or user interaction. Because the CVSS complexity is Low and privileges required are None, this can be automated to enumerate and harvest exposed data at scale. No public exploit code is identified at time of analysis, so an attacker would need to discover the specific vulnerable endpoint.