Low severity3.8NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026
CVE-2026-111609
CVE-2026-111609
Description
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=3.5.0-5
Patches
Vulnerability mechanics
References
4- github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.phpnvd
- github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.phpnvd
- hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idornvd
- www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscriptionnvd
News mentions
0No linked articles in our index yet.