SpiceJet's online booking system contains two high-severity vulnerabilities that allow unauthorized access to passenger data. CVE-2026-6375 enables unauthenticated users to query passenger name records (PNRs) through predictable identifiers due to missing authorization checks. CVE-2026-6376 allows access to full passenger booking details using only PNR and last name without authentication. Both vulnerabilities affect all versions of the SpiceJet Online Booking System and could lead to sensitive information disclosure. SpiceJet has not responded to CISA's coordination attempts, leaving the vulnerabilities unpatched.