CVE-2026-14851: Unauthorised disclosure of information on Copart’s online billing service
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Customers whose invoices are available through the affected online billing application may have personally identifiable information and financial data exposed, including names, addresses, invoice numbers, payment details, and tax information.
What does an attacker need to exploit it?
An attacker needs access to invoice PDF URLs or the ability to identify or predict invoice document identifiers. The affected endpoint lacks authorization checks, so access to a valid document path may be sufficient to retrieve invoice data.
Can publicly indexed documents increase exposure?
Yes. Some invoice document URLs appear to be accessible through search engines, which may expose paths to confidential PDF files without requiring an attacker to predict identifiers.
How can an organization determine whether it may already be affected?
Review whether invoice PDF URLs from the online billing service are indexed by search engines or can be retrieved without authorization. Also assess whether changing or predicting invoice identifiers permits access to other customers' documents.