## PRIORITY PORTAL GENERATOR / CVE-2026-59504
CVE-2026-59504
CWE-602 — Client-Side Enforcement of Server-Side Security
Per its CVSS vector, this is reachable over the network, with no credentials, and no user interaction, under conditions the attacker fully controls.
## WHAT THE WEAKNESS MEANS
A security control that runs in the browser, where the attacker controls the runtime. Anything enforced only on the client can be edited, skipped or replayed, so it enforces nothing against anyone who chooses not to cooperate.
## DECODED CVSS VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vectorNetwork
- Exploitable remotely, over the internet — no foothold on the network is needed first.
- Attack complexityLow
- No special conditions. The attack works reliably, every time, against any affected instance.
- Privileges requiredNone
- No account and no credentials. An anonymous visitor can do this.
- User interactionNone
- No victim needs to click, visit or approve anything. The attacker acts alone.
- ScopeUnchanged
- The impact stays inside the vulnerable component’s own security authority.
- Confidentiality impactHigh
- Total loss of confidentiality — every piece of data the component can reach is readable by the attacker.
- Integrity impactHigh
- Total loss of integrity — the attacker can modify any data the component holds, and the modification is fully under their control.
- Availability impactNone
- Availability is unaffected.
## AFFECTED & MITIGATION
Affected: Portal Generator addon to Priority ERP (developed by Soft Solutions), all versions without Priwall v3. Not affected when Priwall v3 is deployed — this is a mitigation, not a patch to the addon itself.
Discovered November 2025 and disclosed 13 August 2026 through INCD. Around 415 vulnerable instances were found online, 269 of them in Israel, many serving hundreds of downstream businesses. Roughly 2,278 accessible data sets were reachable, including financial records, customer data and user accounts.
Research by Roei Hadashi and Dean Bar at HackersEye.
read the full technical writeup on hackerseye.com →## THE OTHER 8 CVES
- CVE-2026-59500 Improper Authentication 10.0
- CVE-2026-59506 Missing Authentication for Critical Function 9.3
- CVE-2026-59507 Use of Hard-coded Credentials 9.3
- CVE-2026-59503 Exposure of Private Personal Information 9.1
- CVE-2026-59499 Exposure of Sensitive Information 8.6
- CVE-2026-59505 Improper Access Control 8.6
- CVE-2026-59501 Improper Access Control 8.2
- CVE-2026-59502 Observable Discrepancy 5.3