What’s Vulnerable › Vulnerabilities

CVE-2026-111609: PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

• Severity: low (CVSS 3.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-21
• Weakness: CWE-639

Description

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

Affected products

• PKP Open Journal Systems: through 3.5.0-5

References

• https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51
• https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62
• https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor
• https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription
• https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor

Get alerted when CVE-2026-111609 or the next vulnerability affects your stack