EUVD-2026-57771
GHSA-2wv9-fhg5-594v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable, low-complexity, unauthenticated bypass of client-side controls yields high confidentiality (C:H); integrity downgraded to I:L as the evidence points to information disclosure, not broad data modification.
Primary rating from Vendor (INCD).
CVSS VectorVendor: INCD
Lifecycle Timeline
2DescriptionCVE.org
CWE-602: Client-Side Enforcement of Server-Side Security
AnalysisAI
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to a deployed Priority ERP Portal Generator instance that exposes functionality gated only by client-side controls; the attacker must be able to send direct HTTP requests to the server (e.g., via a proxy) rather than only using the intended UI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and no availability impact - a severe combination on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis and no exact fix version is present in the available data, so operators should contact Soft Solutions / Priority directly and monitor the INCD advisory listing at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 for a patched build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to Priority ERP Portal Generator systems and review access logs for unauthorized data retrieval. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauth
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solu
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Soluti
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solution
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions
Observable discrepancy exposure in the Priority Portal Generator Addon to Priority ERP (developed by Soft Solutions) ena
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today