Information Disclosure Vulnerability in Copart's Online Billing Service

CVE-2026-14851

What is CVE-2026-14851?

This vulnerability involves the unauthorized exposure of sensitive information in Copart's customer invoicing web application. Due to insufficient authorization checks at the endpoint responsible for serving PDF invoice files, critical personally identifiable information (PII) such as customer names, addresses, invoice numbers, payment details, and tax information may be accessed by unauthorized individuals. Additionally, certain URLs for invoicing documents are discoverable through search engines, further compromising the confidentiality of data. Exploiting this vulnerability allows attackers to not only access restricted data but also predict identifiers to gain entry to even more sensitive information.

References