CVE-2026-61344

Superior Court of California Hearing Reminder Service unauthenticated information disclosure

Published Jul 9, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication.

Analysis

Technical impact

A public API endpoint of the Superior Court of California Hearing Reminder Service returns court reminder records that may include sensitive information without requiring authentication. The weakness is a missing authentication check, which is classified as CWE‑306. The impact is a moderate level of confidential data exposure; an attacker could retrieve personal details or case information that should be protected.

Affected Systems

The vulnerability affects the Superior Court of California, County of Los Angeles Hearing Reminder Service. No specific product versions are listed in the available data, and the location of the exposed API is https://www.hrs.courts.ca.gov.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS score is <1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an unauthenticated web API accessible to anyone on the public internet.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Superior Court of California, County of Los Angeles

Hearing Reminder Service

unknown

Version	Status	Constraints
`0`	affected	< 2026-04-28
`2026-04-28`	unaffected	—

No data.

Vendor Product Versions

Superior Court Of California

Hearing Reminder Service

Version	Status	Scheme	Platform
`[0,2026-04-28)`	affected	generic	—
`2026-04-28`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Add authentication to the hearing reminder API to restrict access to authorized users
Limit the data the API returns to only non-sensitive fields or mask sensitive information
Enforce network or application‑level access controls to ensure only trusted parties can query the endpoint
Conduct a security review of all exposed endpoints to identify and remediate similar misconfigurations

Generated by OpenCVE AI on August 1, 2026 at 14:10 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.473% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-02.json
https://www.cve.org/CVERecord?id=CVE-2026-61344
https://www.hrs.courts.ca.gov

History

Jul 21, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 10, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Superior Court Of California Superior Court Of California hearing Reminder Service
Vendors & Products		Superior Court Of California Superior Court Of California hearing Reminder Service

Jul 9, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication.
Title		Superior Court of California Hearing Reminder Service unauthenticated information disclosure
Weaknesses		CWE-306
References		https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-02.json https://www.cve.org/CVERecord?id=CVE-2026-61344 https://www.hrs.courts.ca.gov
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`