EUVD-2026-42663
GHSA-3q6q-8gwq-hrm6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with no authentication (PR:N, AC:L); impact is read-only partial confidentiality disclosure (C:L) with no integrity or availability effect and unchanged scope.
Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725).
CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725
Lifecycle Timeline
2DescriptionCVE.org
The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication.
AnalysisAI
Unauthenticated API exposure in the Superior Court of California's Hearing Reminder Service (hrs.courts.ca.gov) permits any internet-accessible party to retrieve court reminder records containing potentially sensitive information with no credentials or preconditions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote access, making bulk data harvesting trivial for any motivated actor. No public exploit code has been identified at time of analysis, and the service is not listed in the CISA KEV catalog, but the low technical barrier means exploitation requires nothing more than a standard HTTP request.
Technical ContextAI
CWE-306 (Missing Authentication for Critical Function) identifies the root cause: an API endpoint of the Hearing Reminder Service returns records to any caller without enforcing an authentication check. The affected system is a California judicial branch web application hosted at https://www.hrs.courts.ca.gov, likely implemented as a REST or similar HTTP API backend. No CPE strings were provided in the intelligence data, so affected software versions cannot be enumerated from NVD CPE identifiers. The application manages court hearing reminder records - data that may include case numbers, party names, contact details, and scheduled hearing dates - and exposes at least one endpoint without access control, allowing unauthenticated reads. A CSAF advisory (va-26-190-02.json) has been published to the CISA repository, indicating government-coordinated disclosure.
RemediationAI
The primary fix is to implement authentication and authorization controls on the affected API endpoint, ensuring that court reminder records are returned only to verified and authorized requestors - such as authenticated court staff, registered members of the public with validated sessions, or systems using API keys with appropriate scoping. While a fix is being developed or deployed, compensating controls include: restricting access to the API endpoint via network-layer allowlisting to known judicial and partner IP ranges (trade-off: blocks legitimate remote or mobile users who may need access); adding rate limiting and anomaly detection to reduce bulk enumeration (trade-off: does not prevent individual unauthorized reads, only slows mass harvesting); and temporarily disabling or gating the endpoint behind a maintenance page if data sensitivity warrants immediate containment. The CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-02.json should be reviewed for any official remediation guidance issued by the California Courts or CISA. No specific patched software version is available from the provided data, as this is a custom government application.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today