CVE-2026-111609: PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

Q: Which users can exploit this issue?

A journal manager or subscription manager can exploit it. The attack requires authenticated privileges; unauthenticated users are not described as able to use it.

Q: What information and actions are exposed?

An attacker can enumerate sequential subscription IDs through editSubscription to view subscriber details from other journals. They can also submit arbitrary IDs to updateSubscription and reassign another journal's subscriptions to their own journal, revoking the affected subscribers' access.

Q: Are installations affected by default?

The issue affects Open Journal Systems through version 3.5.0-5 where users have journal-manager or subscription-manager access. The provided information does not identify a configuration setting that disables the vulnerable behavior.

Q: How can an administrator check for possible exploitation?

Review subscription-edit and subscription-update activity for managers accessing subscription IDs belonging to different journals, especially sequential ID probing. Investigate subscriptions that have been reassigned to an unexpected journal or where subscribers unexpectedly lost access.

Published Oct 16, 2026

Updated

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

Affected Software

1 affected component

pkp Open Journal Systems<=3.5.0-5

Event History

Oct 16, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

A journal manager or subscription manager can exploit it. The attack requires authenticated privileges; unauthenticated users are not described as able to use it.

What information and actions are exposed?

An attacker can enumerate sequential subscription IDs through editSubscription to view subscriber details from other journals. They can also submit arbitrary IDs to updateSubscription and reassign another journal's subscriptions to their own journal, revoking the affected subscribers' access.

Are installations affected by default?

The issue affects Open Journal Systems through version 3.5.0-5 where users have journal-manager or subscription-manager access. The provided information does not identify a configuration setting that disables the vulnerable behavior.

How can an administrator check for possible exploitation?

Review subscription-edit and subscription-update activity for managers accessing subscription IDs belonging to different journals, especially sequential ID probing. Investigate subscriptions that have been reassigned to an unexpected journal or where subscribers unexpectedly lost access.

CVE-2026-111609: PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information and actions are exposed?

Are installations affected by default?

How can an administrator check for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information and actions are exposed?

Are installations affected by default?

How can an administrator check for possible exploitation?