CVE-2026-6376 Missing authentication for critical function in SpiceJet Online Booking System
Unauthenticated attackers can access full passenger booking details using only a PNR and last name due to missing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6376?
CVE-2026-6376 is a high-severity missing authorization vulnerability in SpiceJet Online Booking System, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking metadata to any unauthenticated user who can obtain or guess those basic inputs. The issue arises from improper access control on a sensitive data retrieval function.
Weakness: CWE-306
Which versions are affected by CVE-2026-6376?
How do I fix CVE-2026-6376?
No fix has been published for CVE-2026-6376 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-6376 being exploited?
There is no known exploitation of CVE-2026-6376 in the wild and no public exploit code.
Sources
Also known as GHSA-2pp5-c2qh-f9wq.