CVE-2026-111609 in Open Journal Systems
Summary
by MITRE • 10/16/2026
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified vulnerability in PKP Open Journal Systems versions up to 3.5-5 represents a critical insecure direct object reference flaw that fundamentally undermines the application's authorization controls. This security defect arises from insufficient validation of user-supplied input when handling subscription-related operations, specifically within the editSubscription and updateSubscription endpoints. The core technical failure lies in the system's reliance on sequential or predictable identifier values for journal subscriptions without implementing proper access control checks to verify that the requesting user possesses administrative privileges over the specific journal associated with the targeted subscription ID. Consequently, any authenticated user holding roles such as journal manager or subscription manager can manipulate these identifiers to interact with resources belonging to other journals within the same instance of the software.
From an operational perspective, this vulnerability enables two distinct and severe attack vectors that compromise both confidentiality and integrity. First, by supplying arbitrary sequential IDs through the editSubscription function, attackers can enumerate valid subscription records across multiple journals. This capability allows for the unauthorized disclosure of sensitive subscriber information, including personal details and contact information, which violates data privacy principles and exposes organizations to potential regulatory penalties under frameworks such as GDPR or CCPA. Second, and more critically, the ability to use updateSubscription to reassign subscriptions effectively permits an attacker to hijack access rights. By transferring a subscription from one journal manager's jurisdiction to another, the attacker can revoke legitimate users' access while granting themselves unauthorized control over those resources. This action disrupts service availability for victims and grants the attacker elevated privileges within the targeted journal ecosystem.
The technical classification of this issue aligns with CWE-284, which describes Improper Access Control, specifically highlighting the failure to enforce proper restrictions on an actor's access to a specific object based upon its identity or role. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates several malicious tactics including Account Manipulation and Data Staged for Exfiltration. The enumeration aspect leverages predictable resource identifiers, which is often associated with CWE-203, Observable Discrepanancy in Response, although the primary severity stems from the lack of object-level authorization checks typical of CWE-639, Authorization Bypass Through User-Controlled Key. These flaws are particularly dangerous because they allow low-privilege users to escalate their influence across organizational boundaries within a multi-journal platform.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is the implementation of robust object-level access control checks that verify the relationship between the authenticated user's assigned journals and the target subscription ID before processing any edit or update requests. Developers should ensure that every API endpoint validates ownership permissions, ensuring that a journal manager can only modify subscriptions explicitly linked to their managed journals. Additionally, replacing sequential integer identifiers with non-sequential, cryptographically random unique identifiers for subscriptions would significantly reduce the feasibility of enumeration attacks, although this alone does not resolve the underlying authorization flaw. Organizations running affected versions should immediately upgrade to patched releases provided by PKP and review audit logs for any signs of unauthorized subscription modifications or data access patterns indicative of exploitation.