Unauthorised disclosure of information on Copart’s online billing service
Customer invoicing web service.
INCIBE has coordinated the disclosure of a critical vulnerability affecting Copart’s invoicing web service, a platform that connects sellers with buyers worldwide. The vulnerability was discovered by Mario Romeo Lázaro.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-14851: CVSS v4.0: 9.2 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CWE-200
No solution has been reported as yet.
CVE-2026-14851: a vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-14851 | Crítica | No | COPART |
