Threat database

CVE-2026-14851 is a critical vulnerability in Copart’s online billing service that exposes sensitive customer information such as names, addresses, invoice numbers, payment details, and tax information. The flaw arises from missing authorization checks on the endpoint serving PDF invoice files, allowing unauthorized access. Additionally, some invoice document URLs are publicly indexed by search engines, further exposing confidential data. Exploiting this vulnerability enables attackers to access and potentially enumerate sensitive financial and personal data.