{"id":"CVE-2026-111609","kind":"vulnerability","aliases":["CVE-2026-111609"],"related":[],"title":"PKP Open Journal Systems: subscription IDs let journal managers read and reassign other journals' subscriptions","description":"PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.","summary":"PKP Open Journal Systems through 3.5.0-5 does not check that a subscription belongs to the requesting journal. A journal or subscription manager can enumerate sequential subscription IDs to view other journals' subscriber details and reassign those subscriptions to their own journal, cutting off the victims' access.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["journal-hosting","ojs","package","pkp","self-hosted"],"not_affected_if":["single-journal-install","trusted-managers-only"],"how_to_check":"- Check the installed OJS version in the site's version file or admin dashboard; versions through `3.5.0-5` are affected.\n- Confirm whether multiple journals share one OJS installation with subscription management enabled.","fix":"- Upgrade Open Journal Systems past `3.5.0-5` to a fixed release (unknown from the sources; check the PKP release notes).\n- Until patched, restrict journal and subscription manager accounts to trusted staff.","status":"open","published_at":"2026-10-16T18:17:40+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:29:17+00:00","updated_at":"2026-10-25T04:29:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Open Journal Systems past `3.5.0-5` to a fixed release (unknown from the sources; check the PKP release notes).\n- Until patched, restrict journal and subscription manager accounts to trusted staff.","reach":"internet","title":"PKP Open Journal Systems: subscription IDs let journal managers read and reassign other journals' subscriptions","impact":"medium","summary":"PKP Open Journal Systems through 3.5.0-5 does not check that a subscription belongs to the requesting journal. A journal or subscription manager can enumerate sequential subscription IDs to view other journals' subscriber details and reassign those subscriptions to their own journal, cutting off the victims' access.","category":"package","nicknames":[],"who_cares":["ojs","pkp","self-hosted","journal-hosting"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other journals' subscriber details are readable and subscriptions can be taken over.","analyst_note":"Check the NVD entry and the PKP advisory for the fixed version number; the sources here give none.","how_to_check":"- Check the installed OJS version in the site's version file or admin dashboard; versions through `3.5.0-5` are affected.\n- Confirm whether multiple journals share one OJS installation with subscription management enabled.","needs_analyst":true,"not_affected_if":["single-journal-install","trusted-managers-only"],"who_is_affected":"Installations hosting several journals on one OJS instance where some users hold journal or subscription manager roles. Single-journal sites where every manager is trusted face less exposure, since the risk is one journal reaching another journal's subscriptions.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":3353,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111609':18A,21A '-2026':17A,20A '-5':37B,84C '3.5.0':36B,83C 'access':77B,99C,131C 'allow':93C 'arbitrari':105C 'attack':108C 'belong':44B 'check':40B 'contain':85C 'cut':73B 'cve':16A,19A 'detail':64B,118C 'direct':88C 'editsubscript':114C 'enumer':55B,110C 'host':24B,30B 'id':6A,58B,107C,112C 'insecur':87C 'journal':3A,8A,14A,23B,33B,48B,50B,62B,72B,80C,94C,101C,128C 'journal-host':22B 'let':7A 'manag':9A,53B,97C 'object':89C 'oj':25B 'open':2A,32B,79C 'packag':26B 'pkp':1A,27B,31B,78C 'read':10A 'reassign':12A,66B,123C 'refer':90C 'request':47B 'revok':129C 'self':29B 'self-host':28B 'sequenti':56B,111C 'subscrib':63B,117C 'subscript':5A,15A,43B,52B,57B,68B,96C,102C,106C,124C 'suppli':104C 'system':4A,34B,81C 'updatesubscript':121C 'use':120C 'victim':76B,130C 'view':60B,116C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Installations hosting several journals on one OJS instance where some users hold journal or subscription manager roles. Single-journal sites where every manager is trusted face less exposure, since the risk is one journal reaching another journal's subscriptions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111609","severity":null,"published_at":"2026-10-16T18:17:40+00:00","modified_at":"2026-10-21T03:17:19+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}