---
id: CVE-2026-111609
title: >-
  PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via
  updateSubscription
summary: >-
  PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object
  reference vulnerability that allows journal or subscription managers to access
  other journals' subscriptions by supplying arbitrary subscription ids.
  Attackers c…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: PKP
product: Open Journal Systems
affected:
  - open_journal_systems <= 3.5.0-5
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:38:49.767Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111609'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor'
  - url: >-
      https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51
  - url: >-
      https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62
  - url: >-
      https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription
    label: >-
      VulnCheck Advisory: PKP Open Journal Systems through 3.5.0-5 Cross-Journal
      Subscription IDOR via updateSubscription
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.697Z'
---

## Overview

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

## Affected

- `open_journal_systems <= 3.5.0-5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.