Which versions of SpiceJet Booking System are affected by EUVD-2026-25299?

SpiceJet's Online Booking System contains an unauthenticated information disclosure vulnerability allowing remote attackers to retrieve and enumerate passenger booking records and names at scale.

How to fix or mitigate EUVD-2026-25299?

Within 24 hours: Restrict public internet access to the vulnerable profile endpoint using network controls, API gateway rules, or temporary service suspension; enable comprehensive request logging to detect any ongoing exploitation attempts. Within 7 days: If the endpoint must remain operational, implement mandatory authentication and authorization checks (requires code deployment); deploy rate limiting and request throttling to prevent bulk enumeration; audit accumulated access logs for indicators of prior unauthorized data harvesting. Within 30 days: Deploy Web Application Firewall (WAF) rules to detect and block enumeration patterns; evaluate feasibility of migrating to non-sequential PNR identifiers; conduct regulatory impact assessment and initiate customer notification procedures per applicable data protection laws (GDPR, local variants); perform comprehensive API security audit across the booking platform to identify similar authorization flaws.

SpiceJet Booking System EUVD-2026-25299

Q: What is the CVSS score of EUVD-2026-25299?

EUVD-2026-25299 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-6375 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-23 icscert

GHSA-x532-492q-g257

Authentication Bypass Online Booking System

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network access with no user interaction (PR:N/UI:N/AC:L); bulk PNR/passenger-name disclosure sets C:H while no integrity or availability impact yields I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:28 vuln.today

CVSS changed

Apr 23, 2026 - 21:27 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 21:00 euvd

EUVD-2026-25299

CVE Published

Apr 23, 2026 - 20:07 nvd

HIGH 8.7

DescriptionCVE.org

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.

AnalysisAI

Unauthorized passenger data disclosure in SpiceJet's Online Booking System lets unauthenticated remote attackers retrieve passenger name records (PNRs) and associated names by directly querying a profile endpoint that lacks authorization checks. Because PNR identifiers are predictable, records can be enumerated in bulk to harvest passenger names at scale. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), but CISA's SSVC assessment flags the flaw as automatable with partial technical impact, and it is tracked as an ICS advisory (ICSA-26-113-04) and EU EUVD-2026-25299.

Technical ContextAI

This is a broken object-level authorization (BOLA/IDOR) issue classified as CWE-639, Authorization Bypass Through User-Controlled Key. The affected component is SpiceJet's web-based Online Booking System (cpe:2.3:a:spicejet:online_booking_system:*), specifically a REST-style booking/profile API endpoint that was designed to serve authenticated profile lookups. The root cause is that the endpoint trusts a client-supplied PNR identifier as the sole selector for returning a record without verifying that the requesting session is authorized to view that record. Compounding the design flaw, the PNR identifier space is not high-entropy or random but follows a predictable, sequential-style pattern, converting a per-record authorization gap into a mass-enumeration data-exposure primitive.

RemediationAI

No vendor-released patch version is identified at time of analysis; because this is a hosted service the fix must be applied server-side by SpiceJet and cannot be independently version-confirmed. Refer to the CISA ICS advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-04) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-6375) for operator guidance. The primary remediation is to enforce object-level authorization on the PNR/profile endpoint so that a session may only retrieve records it owns, rejecting requests for arbitrary PNRs. As compensating controls the operator should replace predictable PNR identifiers with unguessable, high-entropy tokens for API lookups (side effect: may require mapping-layer changes and could break integrations that assume the legacy PNR format); require authentication plus an ownership check (e.g., matching booking email/phone) before returning any record (side effect: adds friction to legitimate anonymous 'manage booking' flows); and apply strict per-IP and per-session rate limiting with anomaly detection on the endpoint to blunt enumeration (side effect: aggressive limits can throttle legitimate high-volume traffic such as travel agents). As an interim measure, WAF rules blocking rapid sequential PNR queries can slow, but not fully stop, enumeration.