Copart online billing service: Unauthorised disclosure of invoice data
Summary
The Copart online billing service, which issues invoices to buyers and sellers, lacks authorisation checks on the endpoint that serves PDF invoice files. An unauthenticated remote attacker can access invoices containing personal data and financial information, such as names, addresses, invoice numbers, payment details and tax information. Some invoice URLs are also indexed by search engines, and identifiers may be predictable, which could allow access to further records.
Affected
- Copart online billing service (customer invoicing web application)
- Date range in the CNA record: before 14/10/2026
- No software versions published. Unknown which builds or service versions are affected.
Fixed in
Unknown. No solution has been reported as yet.
Workaround
No vendor workaround published.
- Ask Copart in writing whether your company's invoices were exposed, for which period, and when a fix is planned.
Exploitation
- No exploitation reported.
- Not listed in CISA KEV.
- EPSS: 0.00332.
- No public proof of concept found.
Our recommendation
- If your company uses this Copart service, ask Copart in writing whether your invoices were exposed and request their remediation timeline.
- Check whether invoice PDF URLs appear in search engine results.
- Warn staff and customers about phishing and fraud, such as fake payment-change requests.
- Assess data protection duties under the revised FADP (and GDPR where relevant) with your DPO or legal adviser.
- Track the vendor response and re-check the INCIBE notice and NVD, as the fix status is unknown.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT advisory INCIBE-2026-742 www.incibe.es
- Vulners CVE record (CNA data) vulners.com
- VulDB entry CVE-2026-14851 vuldb.com
- Strix CVE summary CVE-2026-14851 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:37.
Original description (NVD)
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.