Vulnerability · Published Apr 23, 2026 · Assigned by icscert

CVE-2026-6375Authorization bypass through User-Controlled key in SpiceJet Online Booking System

High 8.7

In plain English

A high-severity authorization bypass via user-controlled key in Online Booking System from SpiceJet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 75.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.

Affected products (as reported)

Vendor	Product	Versions
SpiceJet	Online Booking System	All

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-04