Copart Online Billing EUVD-2026-100940

No special conditions beyond network reachability - remote unauthenticated exploitation (PR:N/UI:N) against Copart's Online Billing Service, specifically the endpoint that serves PDF invoice files, which performs no authorization check before returning documents. Exploitation is further eased because some invoice document URLs are publicly indexed by search engines and because invoice identifiers are predictable, allowing enumeration. The practical limiting factor is that exploitation targets a single vendor-hosted web application rather than on-premises software, so impact is confined to Copart's billing customers and depends on the current (possibly already remediated) state of that hosted service.

The CVSS 4.0 base score of 9.2 (Critical) is driven by a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high confidentiality impact on both the vulnerable system (VC:H) and a subsequent system (SC:H), reflecting broad PII/financial data exposure. However, the technical-impact signal is confidentiality-only (VI:N/VA:N, SI:N/SA:N) - there is no integrity or availability impact, so this is a pure data-exposure flaw rather than a system-takeover issue. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from threat-intel signals; the only exploitation enabler noted is that some invoice URLs are reportedly indexed by search engines, which materially lowers the effort to discover exposed documents. The disclosure originates from INCIBE (Spain's CERT), a credible national coordinator, which supports the validity of the finding, but there is no vendor advisory or fix version in the provided data. Net assessment: a genuinely high-severity confidentiality issue for affected Copart customers because exploitation is trivial and may already be partially achievable via search engines, but the absence of EPSS/KEV/POC data means the 9.2 should be treated as severity-of-impact rather than confirmed widespread exploitation - verify current exposure and indexing status directly.

An unauthenticated attacker browses or guesses the PDF-invoice endpoint URL, which lacks authorization checks, and retrieves invoices belonging to other customers containing names, addresses, invoice numbers, payment details, and tax information. Because invoice identifiers appear predictable, the attacker increments or enumerates IDs to harvest additional customers' documents at scale; some URLs are already reachable through search-engine indexing, so no credentials or prior access are required. No public POC was identified in the provided data.