CVE-2026-14851: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Copart Copart’s online billing service

This vulnerability (CWE-200) in Copart's online billing service arises from a lack of authorization checks on the endpoint responsible for delivering PDF invoice files. As a result, unauthorized actors can access sensitive customer data such as names, addresses, invoice numbers, payment details, and tax information. Additionally, some invoice document URLs are indexed by search engines, making confidential file paths publicly discoverable. Exploitation could enable attackers to retrieve and predict identifiers to access further confidential information. The CVSS 4.0 base score is 9.2, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and scope.

The vulnerability allows unauthorized individuals to access sensitive personal and financial information of customers, including PII and payment details, which can lead to privacy violations and potential financial fraud. The exposure of invoice URLs via search engines further increases the risk of data leakage. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the invoicing endpoint by implementing proper authorization checks and remove or block indexing of invoice URLs from search engines to reduce exposure.