This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), affects the Portal Generator addon to Priority ERP. It allows an unauthenticated attacker to invoke critical functions without proper authentication, potentially leading to a complete confidentiality breach. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available.

The vulnerability allows unauthenticated remote attackers to access critical functions, resulting in a high confidentiality breach. Integrity impact is limited, and availability is not affected. This could lead to unauthorized disclosure of sensitive information within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected addon and monitor for unusual activity related to the Portal Generator functions.