CoreCVE
Back

HIGH

Authorization bypass through User-Controlled key in SpiceJet Online Booking System

Published Apr 23, 2026

Description

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner icscert
Published Apr 23, 2026
Updated Apr 24, 2026
Reserved Apr 15, 2026
Link CVE-2026-6375
CISA Vulnrichment
Updated Apr 24, 2026
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2026-6375
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-6375
ENISA EUVD
Assigner icscert
Published Apr 23, 2026
Updated Apr 24, 2026
Exploited since n/a
Link EUVD-2026-25299
EUVD-2026-25299