---
id: CVE-2026-14851
title: >-
  A vulnerability relating to the exposure of confidential information in the
  customer invoicing web application, which exposes personally identifiable
  information (PII) and financial data – including customer names, addresses,
  invoice num…
summary: >-
  A vulnerability relating to the exposure of confidential information in the
  customer invoicing web application, which exposes personally identifiable
  information (PII) and financial data – including customer names, addresses,
  invoice num…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'
cwe:
  - CWE-200
vendor: Copart
product: Copart’s online billing service
affected:
  - copart_s_online_billing_service < 14/10/2026
published: '2026-10-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:33:47.027'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14851'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/unauthorised-disclosure-information-coparts-online-billing-service
    label: cve-coordination@incibe.es
tags:
  - nvd
  - cve.org
epss: 0.00332
epssPercentile: 0.26291
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T14:14:46.650420Z'
cvssSource: cna
ingestedAt: '2026-10-14T09:24:26.063Z'
---

## Overview

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.