Part of the problem with (most) airline web sites is that they still rely on very old mainframe reservation systems. These run low-abstraction code and use fixed-format EDIFACT messaging (often using ALC, a six-bit character set predating ASCII), and are therefore hard to work with and hard to connect to modern web infrastructure.
ITA Software (which I cofounded but at which I'm no longer an employee, and which is now part of Google) has been working on a new reservation system built on modern technologies. This is a monumental undertaking, but they have already launched with at least one airline.
It'll get better, but for the next few years, at least, airline websites are going to be patchwork quilts prone to this sort of problem.
Looks a lot like a backend session key collision. Some session could see passenger manifests, others shouldn't and someone got accidentally merged into the one that could. I'll start checking my apps and see whether low and high sensitivity information use different code paths and maybe rely on layered sessions or something like that from now on.
Yes, or it could be that a web session got improperly connected to a reservation system session with additional privileges. The res system has its own notion of sessions and privileges, completely independent of web session management. With ITA's res system, you keep the web view of the system completely in sync with the reference view in the res system because the web infrastructure can actually talk directly to the res system using a real API. With a legacy res system running in TPF on a mainframe, it's not so simple, because you have to intermediate everything through very old protocols and transports that were designed long before Tim Beners-Lee set fingers to keyboard.
The design of the interface will probably reflect some of the architecture of the back-end - if all connections are virtual and go through one or more physical ports or if each connection requires a physical connection (that may be multiplexed into something else on its way to the heavy iron). I designed a much simpler thing that connected a PC running a Visual Basic app (cut me some slack - it was 92 or so) between a SQL Server and an AS/400 machine through an ancient ISA board that was only happy under OS/2 but tolerated DOS enough to cooperate a little. It was quite an experience - at least the data arrived in ASCII.
I have no idea what United is running (besides the Windows ASP.NET front-end), but I wouldn't be surprised if it's something complicated enough to induce programming errors in clever people.
ITA's quizzes more than once inspired me on tests I subjected candidates to in order to gain a better understanding of the plumbing inside their heads. I assume the reservation system plumbing is equally interesting.
ITA Software (which I cofounded but at which I'm no longer an employee, and which is now part of Google) has been working on a new reservation system built on modern technologies. This is a monumental undertaking, but they have already launched with at least one airline.
It'll get better, but for the next few years, at least, airline websites are going to be patchwork quilts prone to this sort of problem.