CVE-2026-111609
Received Received - Intake

Insecure Direct Object Reference in PKP Open Journal Systems

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111609
EUVD
EUVD-2026-103031

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PKP Open Journal Systems 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in PKP Open Journal Systems through version 3.5.0-5. It allows journal or subscription managers to access or modify subscriptions belonging to other journals by supplying arbitrary subscription IDs. Attackers can enumerate sequential IDs to view sensitive subscriber details or reassign subscriptions to their own journal, revoking access from original subscribers.

Detection Guidance

To detect this IDOR vulnerability, check OJS logs for unauthorized access attempts to subscription IDs outside the current journal context. Look for sequential ID enumeration in editSubscription or updateSubscription actions. Manually test by attempting to access or modify subscriptions with arbitrary IDs while logged in as a journal or subscription manager.

Impact Analysis

If you manage a journal using PKP Open Journal Systems up to version 3.5.0-5, an attacker with manager privileges in another journal could access or steal your subscriber data. They could also revoke access to your journal by reassigning subscriptions to their own journal, disrupting your operations and compromising subscriber information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's privacy rules. Exposure of subscriber details may result in non-compliance with these regulations, potentially leading to legal penalties and reputational damage for affected organizations.

Mitigation Strategies

Immediately upgrade OJS to a patched version beyond 3.5.0-5. If upgrading is not possible, restrict access to subscription management functions to trusted users only. Review all subscription records for unauthorized changes and revoke any subscriptions reassigned to unauthorized journals.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart