---
id: "CVE-2026-111609"
kind: "vulnerability"
aliases: ["CVE-2026-111609"]
title: "PKP Open Journal Systems: subscription IDs let journal managers read and reassign other journals' subscriptions"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["journal-hosting", "ojs", "package", "pkp", "self-hosted"]
not_affected_if: ["single-journal-install", "trusted-managers-only"]
published_at: "2026-10-16T18:17:40+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:29:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111609", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# PKP Open Journal Systems: subscription IDs let journal managers read and reassign other journals' subscriptions

PKP Open Journal Systems through 3.5.0-5 does not check that a subscription belongs to the requesting journal. A journal or subscription manager can enumerate sequential subscription IDs to view other journals' subscriber details and reassign those subscriptions to their own journal, cutting off the victims' access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OJS version in the site's version file or admin dashboard; versions through `3.5.0-5` are affected.
- Confirm whether multiple journals share one OJS installation with subscription management enabled.

## Fix

- Upgrade Open Journal Systems past `3.5.0-5` to a fixed release (unknown from the sources; check the PKP release notes).
- Until patched, restrict journal and subscription manager accounts to trusted staff.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111609

## From the sources

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_