The vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) because the endpoint lacks proper authorization checks. This flaw enables the disclosure of sensitive passenger information, violating privacy and potentially exposing personal data to malicious actors. The weakness is a classic example of missing access control (CWE-639).

SpiceJet Online Booking System. No specific product version or configuration details are provided, but the affected component is the public-facing API that serves PNR data to any requester.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% signals a low but non‑zero exploitation probability in the current environment. The vulnerability is not listed in CISA’s KEV catalog, meaning it has not yet been registered as a known exploited vulnerability. Attackers can exploit this flaw purely by sending requests to the exposed API, using predictable PNR identifiers to enumerate and retrieve passenger names. The attack requires no authentication and no special privileges, so it can be automated and carried out by any user with internet access to the booking system.