A lack of authorization checks at the endpoint responsible for delivering PDF invoices allows any user to retrieve sensitive documents, exposing personally identifiable information, addresses, invoice numbers, payment details and tax data. The flaw is driven by the absence of access control and also by publicly discoverable URLs that surface in search engines, enabling an attacker to guess or request additional confidential files. The result is a high‑severity disclosure of data that should not be publicly available.

The vulnerability affects Copart’s online billing service. No specific version numbers are disclosed, so the entire service should be considered at risk until a patch or remediation is issued.

The CVSS score of 9.2 classifies the flaw as Critical. The EPSS score of less than 1% indicates a low current exploitation probability, yet the impact remains high because an attacker can remotely obtain sensitive documents without any credentials. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants proactive attention. Attackers can exploit the flaw by sending HTTP requests to exposed endpoints, leveraging publicly shareable URLs to bypass access controls.