Online Booking System
Monthly
Broken access control in SpiceJet's Online Booking System exposes complete passenger records through the public booking-retrieval page, which requires only a PNR code and passenger last name with no authentication or ownership verification. Any unauthenticated internet user who obtains or guesses these two inputs can retrieve extensive personal, travel, and booking metadata. No public exploit has been identified at time of analysis and EPSS is low (0.06%), but CISA's SSVC framework rates the flaw as automatable, meaning enumeration at scale is technically feasible.
Unauthorized passenger data disclosure in SpiceJet's Online Booking System lets unauthenticated remote attackers retrieve passenger name records (PNRs) and associated names by directly querying a profile endpoint that lacks authorization checks. Because PNR identifiers are predictable, records can be enumerated in bulk to harvest passenger names at scale. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), but CISA's SSVC assessment flags the flaw as automatable with partial technical impact, and it is tracked as an ICS advisory (ICSA-26-113-04) and EU EUVD-2026-25299.
Broken access control in SpiceJet's Online Booking System exposes complete passenger records through the public booking-retrieval page, which requires only a PNR code and passenger last name with no authentication or ownership verification. Any unauthenticated internet user who obtains or guesses these two inputs can retrieve extensive personal, travel, and booking metadata. No public exploit has been identified at time of analysis and EPSS is low (0.06%), but CISA's SSVC framework rates the flaw as automatable, meaning enumeration at scale is technically feasible.
Unauthorized passenger data disclosure in SpiceJet's Online Booking System lets unauthenticated remote attackers retrieve passenger name records (PNRs) and associated names by directly querying a profile endpoint that lacks authorization checks. Because PNR identifiers are predictable, records can be enumerated in bulk to harvest passenger names at scale. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), but CISA's SSVC assessment flags the flaw as automatable with partial technical impact, and it is tracked as an ICS advisory (ICSA-26-113-04) and EU EUVD-2026-25299.