CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service
Attackers can access confidential PII and financial data due to missing authorization checks on invoice endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14851?
CVE-2026-14851 is a critical missing authorization vulnerability in Copart’s online billing service, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
Weakness: CWE-200
Which versions are affected by CVE-2026-14851?
How do I fix CVE-2026-14851?
No fix has been published for CVE-2026-14851 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-14851 being exploited?
There is no known exploitation of CVE-2026-14851 in the wild and no public exploit code.
Sources
Also known as GHSA-cvj8-qjr2-gmp7.