CVE-2026-6376 SpiceJet CVE debrief

Who should care

SpiceJet web and application security teams, booking-platform owners, privacy and compliance teams, and incident responders responsible for customer-data exposure and public-facing retrieval portals.

Technical summary

The advisory describes a network-reachable booking lookup function that lacks proper access control. Using only a PNR and last name, an unauthenticated requester can access full passenger booking details and associated metadata. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact with no integrity or availability impact. The source also includes an SSVC note of E:N/A:Y dated 2026-04-22T06:00:00Z.

Defensive priority

High. This is a public-facing, unauthenticated data exposure affecting sensitive customer information, so it should be treated as an urgent access-control and privacy-risk issue.

Recommended defensive actions

• Disable or tightly gate the public booking-retrieval function until server-side authentication and authorization are enforced.
• Replace PNR-plus-last-name lookup with stronger verification and minimize the data returned to only what is operationally necessary.
• Add monitoring and logging for booking-lookup activity, including repeated or high-volume queries that may indicate enumeration.
• Review whether customer booking data was exposed and follow internal privacy, legal, and incident-response procedures as appropriate.
• Coordinate with SpiceJet using the published contact path and track remediation status before re-enabling any public retrieval capability.

Evidence notes

Based on CISA CSAF advisory ICSA-26-113-04 and its source JSON, both published on 2026-04-23, which state that SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed with only a PNR and last name and no authentication or verification. The source metadata also notes that SpiceJet did not respond to CISA’s coordination requests. No exploitation report or KEV listing is present in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.