Read the docs
TI-2026-75395 Aliases CVE-2026-111609GHSA-rwgq-cgw6-3p37

PKP Open Journal Systems exposes other journals' subscriptions

Priority MEDIUM 56CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference (CWE-639). A journal or subscription manager can supply arbitrary subscription ids to view other journals' subscriber details and reassign their subscriptions to their own journal, which revokes the victims' access.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pkpOpen Journal Systemsup to 3.5.0-5—No fix listedCNA
  • Open Journal Systems Vendorpkp Affected up to 3.5.0-5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for PKP Open Journal Systems.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111609
  2. 2026-10-16 Alias added: GHSA-rwgq-cgw6-3p37
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2023-05431 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05430 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05429 Cross-Site Request Forgery (CSRF) in pkp/customLocale CVSS 3.1HIGH 8.8
  • TI-2023-05425 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05178 Cross-Site Request Forgery (CSRF) in pkp/ojs CVSS 3.1HIGH 8.8
  • TI-2023-04327 Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib CVSS 3.1HIGH 8.1
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences