CVE-2026-111609

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51
https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62
https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor
https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription
https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor

Configurations

No configuration.

History

21 Oct 2026, 03:17

Type	Values Removed	Values Added
References	~~() https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor -~~	() https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor -

16 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-16 18:17

Updated : 2026-10-21 03:17

NVD link : CVE-2026-111609

Mitre link : CVE-2026-111609

CVE.ORG link : CVE-2026-111609

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-111609", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111609", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-21T02:31:28.950811Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/pkp/ojs", "vendor": "PKP", "product": "Open Journal Systems", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.5.0-5"}], "packageURL": "pkg:github/pkp/ojs", "defaultStatus": "unaffected"}]}], "published": "2026-10-16T18:17:40.103", "references": [{"url": "https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access."}], "lastModified": "2026-10-21T03:17:19.073", "sourceIdentifier": "disclosure@vulncheck.com"}