CVE-2026-111609 PKP CVE debrief

Who should care

Defenders responsible for managing and securing PKP Open Journal Systems, particularly those with journal or subscription management roles, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-111609 is a medium-severity vulnerability in PKP Open Journal Systems that allows journal or subscription managers to access other journals' subscriptions, potentially leading to unauthorized access and subscription manipulation. Defenders should prioritize verifying and restricting subscription management access, reviewing and securing subscription IDs, and monitoring for potential unauthorized access.

• Potential unauthorized access to subscription information
• Possible manipulation of subscriptions by malicious actors
• Need for verification and restriction of subscription management access
• Importance of monitoring for potential unauthorized access

Technical summary

The vulnerability allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription IDs, potentially leading to unauthorized access and subscription manipulation. This insecure direct object reference vulnerability in PKP Open Journal Systems through 3.5.0-5 could allow attackers to enumerate sequential IDs through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access. Defenders should prioritize verifying and restricting subscription management access, reviewing and securing subscription IDs, and monitoring for potential unauthorized access.

Defensive priority

Defenders should prioritize verifying and restricting subscription management access, reviewing and securing subscription IDs, and monitoring for potential unauthorized access.

Recommended defensive actions

• Verify and restrict subscription management access
• Review and secure subscription IDs
• Monitor for potential unauthorized access
• Perform a thorough review of subscription management roles and permissions
• Implement additional monitoring and logging to detect potential unauthorized access attempts
• Conduct a comprehensive review of system logs to identify potential security breaches
• Review and update incident response plans to address potential security incidents related to this vulnerability

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions, exploitation, and remediation is limited. The vulnerability has been described as allowing journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription IDs. However, specific details about the exploitation and the exact scope of the vulnerability are not provided in the available sources. Defenders should verify the affected versions, review subscription management access,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.