CVE-2026-6375 SpiceJet CVE debrief

Who should care

Security teams responsible for web applications, booking or reservation platforms, identity and access control, API security, and data privacy should prioritize this issue. Operations, incident response, and compliance teams should also care because the flaw exposes passenger data through an internet-facing service.

Technical summary

The source advisory says the booking API lacks authorization checks, allowing unauthenticated queries for PNRs. Because the identifiers follow a predictable pattern, an attacker could enumerate valid records rather than needing prior access. The impact described in the source is confidentiality loss: passenger names tied to PNRs may be disclosed. The provided CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, consistent with network-reachable, low-complexity, unauthenticated information disclosure.

Defensive priority

High. The issue is externally reachable, requires no authentication, and directly exposes personal data. Treat it as a priority exposure review for any affected booking or customer-profile API surface.

Recommended defensive actions

• Restrict the affected endpoint to authenticated, authorized users only.
• Verify authorization on every PNR lookup and ensure access is bound to the requesting account or trusted support workflow.
• Remove or randomize any predictable identifier patterns where feasible, and do not rely on obscurity as a control.
• Add rate limiting, anomaly detection, and logging for repeated PNR lookup attempts and enumeration patterns.
• Review exposed booking and profile APIs for similar missing-authentication or missing-authorization flaws.
• Coordinate with SpiceJet using the contact information provided in the advisory if you operate or integrate with the affected system.

Evidence notes

All claims in this debrief are taken from the supplied CISA CSAF source item for ICSA-26-113-04 / CVE-2026-6375 and its listed references. The source states the flaw affects SpiceJet’s online booking system, that unauthenticated PNR queries are possible, that identifiers are predictable, and that SpiceJet did not respond to CISA’s coordination requests. The source also provides the CVSS vector and CWE-639 reference.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.