CVE-2026-111609
PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 21, 2026
- Reserved
- Oct 16, 2026
Description
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.8 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Open Journal SystemsPKP |
|
References
- https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idorthird-party-advisory
- https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51technical-description
- https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62technical-description
- VulnCheck Advisory: PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscriptionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.