Priority Portal Generator CVE-2026-59504

Exploitation requires network access to a deployed Priority ERP Portal Generator instance that exposes functionality gated only by client-side controls; the attacker must be able to send direct HTTP requests to the server (e.g., via a proxy) rather than only using the intended UI. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed against a reachable instance. The main limiting factor is exposure: portals confined to internal networks, VPNs, or IP allowlists are not remotely reachable by arbitrary attackers, and the impact is bounded to data the portal's server-side handlers can return without re-checking authorization.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and no availability impact - a severe combination on paper. Countervailing signals temper the urgency: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept, so this is a high-CVSS finding without evidence of active or widespread exploitation. There is also a mild internal tension worth verifying with the vendor - the classification and tag emphasize information disclosure (a confidentiality outcome), yet the vector asserts I:H; a pure client-side-control bypass often yields high confidentiality but only limited integrity impact, so the I:H rating may be conservative. On balance this warrants prompt remediation for any operator exposing the Priority portal to untrusted networks, because unauthenticated data exposure is trivially exploitable once discovered, even though the absence of KEV/POC/EPSS signals suggests risk is currently latent rather than demonstrated. Treat the CVSS-versus-tag discrepancy as an open question rather than confirmed fact.

An attacker browses the public Priority portal, then uses an intercepting proxy to replay or modify requests, stripping or altering the client-side parameters the application relied on to limit which records are returned. The server, lacking its own authorization check, returns data belonging to other users or otherwise restricted records, all without any login. No public POC is known, but the low attack complexity (AC:L) and lack of required authentication (PR:N) make manual exploitation straightforward for anyone who can reach the portal.