Description
The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication.
Published: 2026-07-09
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A public API endpoint of the Superior Court of California Hearing Reminder Service returns court reminder records that may include sensitive information without requiring authentication. The weakness is a missing authentication check, which is classified as CWE‑306. The impact is a moderate level of confidential data exposure; an attacker could retrieve personal details or case information that should be protected.

Affected Systems

The vulnerability affects the Superior Court of California, County of Los Angeles Hearing Reminder Service. No specific product versions are listed in the available data, and the location of the exposed API is https://www.hrs.courts.ca.gov.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS score is <1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an unauthenticated web API accessible to anyone on the public internet.

Generated by OpenCVE AI on July 29, 2026 at 12:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Add authentication to the hearing reminder API to restrict access to authorized users
  • Limit the data the API returns to only non-sensitive fields or mask sensitive information
  • Enforce network or application‑level access controls to ensure only trusted parties can query the endpoint
  • Conduct a security review of all exposed endpoints to identify and remediate similar misconfigurations

Generated by OpenCVE AI on July 29, 2026 at 12:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Superior Court Of California
Superior Court Of California hearing Reminder Service
Vendors & Products Superior Court Of California
Superior Court Of California hearing Reminder Service

Thu, 09 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
Description The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication.
Title Superior Court of California Hearing Reminder Service unauthenticated information disclosure
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Superior Court Of California Hearing Reminder Service
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-07-21T17:06:15.001Z

Reserved: 2026-07-08T17:07:47.785Z

Link: CVE-2026-61344

cve-icon Vulnrichment

Updated: 2026-07-21T17:06:10.866Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T12:15:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function