Copart S Online Billing Service
Monthly
Remote unauthenticated attackers can retrieve confidential PDF invoices from Copart's Online Billing Service because the endpoint that serves those documents performs no authorization check, exposing customer names, addresses, invoice numbers, payment details and tax information. Exploitation is made easier by invoice document URLs that are publicly indexed by search engines and by predictable invoice identifiers, which allow an attacker to enumerate and pull additional files beyond any single leaked link. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the CVSS 4.0 base score of 9.2 (Critical) reflects a fully remote, low-complexity, unauthenticated vector with high confidentiality impact on both the vulnerable service and a subsequent system.
Remote unauthenticated attackers can retrieve confidential PDF invoices from Copart's Online Billing Service because the endpoint that serves those documents performs no authorization check, exposing customer names, addresses, invoice numbers, payment details and tax information. Exploitation is made easier by invoice document URLs that are publicly indexed by search engines and by predictable invoice identifiers, which allow an attacker to enumerate and pull additional files beyond any single leaked link. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the CVSS 4.0 base score of 9.2 (Critical) reflects a fully remote, low-complexity, unauthenticated vector with high confidentiality impact on both the vulnerable service and a subsequent system.