A public booking retrieval page exposed the full passenger booking information when accessed with only a PNR and last name. No authentication or verification protects the function, meaning any Internet user can request detailed passenger, travel, and booking metadata. The flaw stems from improper access control, classified as CWE‑306.

The affected product is SpiceJet’s Online Booking System. The CVE does not specify a version range, so every deployment of the current online booking application is at risk until an official fix or configuration change is applied. No other vendor or product is listed.

The vulnerability scores an 8.7 on the CVSSv3 scale, indicating a high impact, and the EPSS score is below 1 %, which means the exploitation probability remains low but still observable. The flaw is not listed in the CISA KEV. Since the data retrieval function is publicly accessible, an attacker only needs the two public inputs—PNR and last name—to extract sensitive data, making exploitation trivial once the inputs are known or guessable.