Low severity · published Oct 16, 2026
CVE-2026-111609
PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
3.8
CVSS
0.3%
EPSS
No
On KEV
Description
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OJ
Open Journal Systems · PKP
through 3.5.0-5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111609
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111609
github.com
https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51
github.com
https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62
hackmd.io
https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription
More from Open Journal Systems
8.8
CVE-2023-5626
Cross-Site Request Forgery (CSRF) in pkp/ojs
6.1
CVE-2024-24511
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component
6.1
CVE-2024-25438
A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into…
6.1
CVE-2024-24512
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component
–
CVE-2012-1469
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or…