CVE-2026-111609 PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
Journal managers can access and modify other journals' subscriptions by manipulating subscription IDs, leading to unauthorized data access and service disruption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111609?
CVE-2026-111609 is a medium-severity missing authorization vulnerability in PKP Open Journal Systems, published on 16 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
Weakness: CWE-639
Which versions are affected by CVE-2026-111609?
How do I fix CVE-2026-111609?
No fix has been published for CVE-2026-111609 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111609 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111609 exists.
Sources
Also known as GHSA-rwgq-cgw6-3p37.