Overview
A critical security vulnerability has been disclosed in the Priority Portal Generator addon for Priority ERP, developed by Israeli software firm Soft Solutions. Tracked as CVE-2026-59504 and scoring CVSS 9.1, the flaw stems from a classic but dangerous design error: security enforcement applied only on the client side, with no corresponding validation on the server.
The Israel National Cyber Directorate published the advisory on August 13, 2026, alongside a companion vulnerability (CVE-2026-59500) in the same product.
Technical Details
The vulnerability is classified under CWE-602: Client-Side Enforcement of Server-Side Security. In this pattern, an application trusts client-submitted data to determine whether access controls or security checks should apply — rather than enforcing those controls independently on the server.
An attacker can craft requests that bypass these client-enforced restrictions entirely, gaining unauthorized access to functionality or data that should have been protected.
CVSS 3.1 vector breakdown:
- Attack Vector: Network — exploitable remotely
- Attack Complexity: Low — no special conditions required
- Privileges Required: None — no authentication needed
- User Interaction: None
- Impact: High Confidentiality, High Integrity, no Availability impact
The 9.1 score reflects the severity of being exploitable by any unauthenticated remote attacker with the ability to send HTTP requests to the affected system.
Affected Product
- Product: Priority Portal Generator (marketed as "Priwall") by Soft Solutions
- Integration: Addon for Priority ERP, a widely-used enterprise resource planning platform in Israel and internationally
- Affected versions: All versions prior to Priwall v3
Remediation
The fix is available: upgrade to Priwall v3. Organizations running any earlier version of the Priority Portal Generator should treat this as an urgent update given the unauthenticated remote exploitability and CVSS 9.1 rating.
Until patching is complete:
- Restrict network access to the Priority Portal from untrusted networks
- Apply WAF rules to monitor for unexpected or anomalous API requests
- Review access logs for signs of unauthorized data access
Context: Paired with CVE-2026-59500
This CVE was disclosed alongside CVE-2026-59500 (CVSS 10.0), which describes a complete authentication bypass in the same product. Organizations should treat both as a package and prioritize upgrading to Priwall v3 immediately — the combination of authentication bypass and client-side security bypass in the same product creates a serious attack surface.