CVE-2026-6376
Last modified
CVE-2026-6376 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking metadata to any unauthenticated user who can obtain or guess those basic inputs. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking metadata to any unauthenticated user who can obtain or guess those basic inputs. The issue arises from improper access control on a sensitive data retrieval function.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-6376?
How severe is CVE-2026-6376?
How do I fix CVE-2026-6376?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-63754SurrealDB versions before 3.1.0 contain a denial of service …7.1
- CVE-2026-63755SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses…7.1
- CVE-2026-63756SurrealDB versions before 3.1.0 contain a time-of-check/time…9.2
- CVE-2026-63757SurrealDB versions before 3.1.0 contain a session hijacking …8.8
- CVE-2026-63758SurrealDB versions before 3.1.0 contain an authorization byp…5.4
- CVE-2026-63759SurrealDB before 3.1.0 fails to enforce recursion depth limi…7.1
- CVE-2026-63760SurrealDB before 3.1.0 fails to enforce the configured recur…8.7
- CVE-2026-63761SurrealDB before 3.1.0 silently substitutes the ES384 algori…5.3
- CVE-2026-63762SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains …6.5
- CVE-2026-63763SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a co…8.8
- CVE-2026-63764LMDeploy through 0.14.0, fixed in commit 03c3130, contains a…8.6
- CVE-2026-63765Chatwoot before 4.16.0 contains an authentication bypass vul…8.8
Are you affected by CVE-2026-6376?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST