CVE-2026-14851
9.2CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200
Impact
Unauthenticated attackers can directly access and harvest customer PII, invoices, and financial records over the network. They only need access to the web endpoint or search engine-indexed file URLs, with predictable IDs enabling bulk scraping.
Root cause
The web application endpoint that serves PDF invoices lacks access control and authorization checks.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Deploy the vendor patch adding authorization checks to the PDF invoicing endpoint. As an immediate mitigation, block external access to the PDF invoice endpoint at the reverse proxy or WAF and enforce strict authentication headers before serving files.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.