CVE-2026-111609

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111609
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111609.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111609
Published
2026-10-16T17:38:49Z
Modified
2026-10-22T02:30:44Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
Details

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111609.json"
}
References

Affected packages

Git / github.com/pkp/ojs

Affected ranges

Type
GIT
Repo
https://github.com/pkp/ojs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
372e3b84740344db6c2f85193c3eb3e4f539cb00
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.5.0-5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

Other
3_2_0-0
3_3_0-0
3_3_0-1
3_4_0rc1
3_4_0rc2
3_4_0rc3
3_5_0-0
3_5_0-1
3_5_0-2
3_5_0-3
3_5_0-4
3_5_0-5
3_5_0rc2
ojs-2_0_0-0
ojs-2_0_1-0
ojs-2_0_2-0
ojs-2_0_2-1
ojs-2_1_0-0
ojs-2_1_0-1
ojs-2_1_1-0
ojs-2_1_1rc4
ojs-2_1b
ojs-2_2_0-0
ojs-2_2_0-b1
ojs-2_2_0-b2
ojs-2_2_1-0
ojs-2_2_1-b1
ojs-2_3_0-0
ojs-2_3_0-0rc1
ojs-2_3_3-0
ojs-2_3_3-1
ojs-2_4_0-0
ojs-3_0a1
ojs-3_0b1
ojs2-base-2_2_2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111609.json"