What’s Vulnerable › Vulnerabilities
CVE-2026-14851: Unauthorised disclosure of information on Copart’s online billing service
- Severity: critical (CVSS 9.2 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-14 · updated 2026-10-15
- Weakness: CWE-200
Description
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
Affected products
- Copart’s online billing service: before 14/10/2026 — fixed in 14/10/2026
How to fix
Upgrade to a fixed version: Copart’s online billing service 14/10/2026. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14851 or the next vulnerability affects your stack