This vulnerability (CVE-2026-6376) involves missing authentication controls (CWE-306) in SpiceJet's Online Booking System, specifically on the public booking retrieval page. An attacker can retrieve complete passenger booking information by supplying only a Passenger Name Record (PNR) and last name, without any authentication or verification. This improper access control leads to exposure of sensitive personal and travel data. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

The vulnerability allows any unauthenticated user to access sensitive passenger booking details, including personal and travel metadata, by knowing or guessing a PNR and last name. This results in significant privacy violations and potential misuse of passenger information. There is no indication of impact on system integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations using the affected system should monitor for vendor updates. Until a fix is available, consider implementing additional access controls or verification mechanisms on the booking retrieval function if possible.