Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111609PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

Low 3.8

In plain English

A low-severity authorization bypass via user-controlled key in Open Journal Systems from PKP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

Affected products (as reported)

Vendor	Product	Versions
PKP	Open Journal Systems	0 – through 3.5.0-5

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor third-party-advisory
https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51 technical-description
https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62 technical-description
VulnCheck Advisory: PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription third-party-advisory