CVE-2026-61344: Unauthenticated API Access to California Court Hearing Reminder Records

Technical summary

CVE-2026-61344 stems from a broken authentication flaw (CWE-306) in the HRS API. The endpoint fails to enforce authentication controls, allowing unauthenticated network requests to retrieve court reminder records. The CVSS 3.1 score of 5.3 (MEDIUM severity) reflects confidentiality impact via low-complexity network access with no user interaction required. The attack vector is network-based, access complexity is low, and no privileges are needed—an attacker simply makes HTTP requests to the vulnerable endpoint from any internet-connected host.

Business impact

For the California court system, this exposure undermines public trust in case management infrastructure and potentially violates privacy expectations around court records. Court users—litigants, attorneys, defendants—may have personal information inadvertently exposed. For other government agencies and courts nationwide, this incident serves as a cautionary example of API security debt in legacy case management systems. Organizations relying on similar reminder or notification services should audit their authentication posture immediately.

Affected systems

The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov is directly affected. The vulnerability is specific to this service's API endpoint and does not appear to affect third-party vendors or products based on available information. However, the scope of affected records depends on how long the endpoint has been exposed and how many reminder records were indexed by the service.

Exploitability

Exploitation is straightforward and does not require advanced techniques. An attacker needs only network connectivity and basic knowledge of the API endpoint structure to retrieve records. No special tools, credentials, or user interaction are necessary. The low access complexity and network availability make this vulnerability practical to exploit at scale. The absence of this vulnerability from the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update does not guarantee that exploitation has not occurred in practice or that weaponized proof-of-concept code does not exist.

Remediation

Immediate action is required: (1) disable or restrict access to the vulnerable API endpoint pending a proper fix; (2) implement authentication and authorization controls (e.g., OAuth 2.0, JWT-based access tokens, or similar) to verify user identity before returning reminder records; (3) audit access logs to determine the scope of exposure and notify affected individuals if necessary; (4) conduct a security review of other API endpoints in the HRS application for similar issues. A permanent fix should include rate limiting, input validation, and encryption of sensitive data in transit and at rest.

Patch guidance

Contact the California Superior Court system directly or monitor their official security advisories at https://www.courts.ca.gov for patches and guidance. Vendor advisories should detail the specific versions affected and the patched version numbers. Until official patches are released, isolate or firewall the vulnerable endpoint and implement temporary access controls (IP allowlisting, WAF rules) if the service must remain operational. Verify all remediation against the official advisory before declaring the vulnerability resolved.

Detection guidance

Monitor API logs for unauthenticated requests to the HRS endpoint, particularly those returning court reminder data. Look for unusual patterns: high request volumes from single IP addresses, requests from unexpected geographies, or sequential record enumeration. Network-based detection: inspect HTTP traffic to https://www.hrs.courts.ca.gov for unencrypted or unvalidated API calls. Endpoint detection and response (EDR) tools should flag any internal processes attempting to extract court records via this API. Implement authentication logging to detect bypass attempts.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the sensitivity of court information and the simplicity of exploitation warrant higher organizational priority. This affects a critical public service, involves personally identifiable information (PII) and case details, and exploitation requires no advanced skills or credentials. Government agencies, courts, and organizations handling similar case management should address this urgently within 30 days.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects low confidentiality impact (not full data breach severity), no integrity or availability impact, network-accessible attack vector, and no authentication requirement. The score is bounded by the fact that only information disclosure occurs; the system remains available and attacker cannot modify records. However, the actual risk to the organization is amplified by the sensitivity of the data (court records), the public nature of the service, and potential regulatory implications under state privacy law.

Frequently asked questions