A vulnerability relating to the exposure of confiden Information Disclosure Flaw CVE-2026-14851 Disclosed

A vulnerability relating to the exposure of confiden is affected by CVE-2026-14851, rated 9.2 (critical). No in-the-wild exploitation has been confirmed in the CISA KEV catalog at the time of writing.

What the flaw is

The NIST National Vulnerability Database describes it as follows:

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.

At a glance

What defenders should do

• Patch: apply the fixed release from A; check the vendor advisory linked below for the exact versions.
• Inventory: identify every instance of A vulnerability relating to the exposure of confiden, prioritising internet-facing ones.