This vulnerability involves an authorization bypass (CWE-639) in SpiceJet's booking API, where unauthenticated users can query PNRs without access checks. The predictable pattern of PNR identifiers facilitates systematic enumeration of passenger records. The flaw is due to missing authorization checks on an endpoint designed for authenticated profile access. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality.

An attacker can retrieve passenger names by enumerating PNRs without authentication, potentially exposing sensitive passenger information. This compromises passenger privacy and could lead to further targeted attacks or identity misuse. The vulnerability does not require authentication or user interaction, increasing the risk of automated exploitation. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint where possible, implement monitoring for unusual access patterns, and consider adding additional access controls or rate limiting as temporary mitigations.