CVE-2026-111609
CVE-2026-111609 · PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
CVSS 5.1 · Mittel · EPSS 0,3%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
open journal systems
- Softwareversionen
- ≥ 0, ≤ 3.5.0-5: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor
- https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51
- https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62
- https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription
- https://nvd.nist.gov/vuln/detail/CVE-2026-111609