CVE-2026-14851

Deferred Deferred - Pending Action

Exposure of Sensitive Information in Customer Invoicing Web Application

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-14851

EUVD

EUVD-2026-100940

Affected Vendors & Products

Vendor	Product	Version / Range
Copart	Copart’s	online billing service 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-14851 is a vulnerability in Copart’s online billing service that exposes confidential customer data due to missing authorization checks in the PDF invoice file endpoint. This flaw allows unauthorized individuals to access personally identifiable information (PII) and financial details such as names, addresses, invoice numbers, payment details, and tax information. Some invoice URLs are also publicly accessible via search engines.

Detection Guidance

Check web server access logs for unusual requests to invoice-related endpoints or PDF file paths. Look for patterns like sequential invoice IDs or direct URL access to /invoice/ or /pdf/ endpoints. Use search engines to verify if invoice URLs are publicly indexed by searching site:yourdomain.com with terms like 'invoice.pdf' or 'invoice?id='.

Impact Analysis

This vulnerability could allow attackers to access your sensitive data, including PII and financial information. They might also predict invoice identifiers to retrieve additional confidential files. If you are a Copart customer, your personal and payment details could be exposed without your knowledge.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized exposure of PII and HIPAA if financial or tax data includes protected health information. Organizations must ensure proper access controls to avoid regulatory penalties and data breach notifications.

Mitigation Strategies

Implement strict authorization checks on all invoice-related endpoints. Remove public access to invoice URLs and block indexing via robots.txt. Update web server configurations to restrict access to sensitive paths. Review and rotate any exposed invoice identifiers to prevent prediction attacks.

Hi! I’m here to help you understand CVE-2026-14851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70