CVE-2026-111609: Authorization Bypass Through User-Controlled Key in PKP Open Journal Systems

PKP Open Journal Systems versions up to 3.5.0-5 contain an authorization bypass vulnerability due to insecure direct object references. Privileged users such as journal or subscription managers can manipulate subscription IDs to access or modify subscriptions belonging to other journals. This is possible because the system does not properly enforce access controls on subscription management functions like editSubscription and updateSubscription, enabling enumeration of subscription IDs and unauthorized reassignment of subscriptions.

An attacker with journal or subscription manager privileges can enumerate subscription IDs of other journals, view subscriber details, and reassign subscriptions to their own journal. This results in unauthorized access to subscriber information and denial of service to legitimate subscribers by revoking their access. The vulnerability does not allow privilege escalation beyond the journal or subscription manager role, but it compromises subscription confidentiality and integrity within the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict journal and subscription manager privileges to trusted users only to limit potential abuse. Monitor for unusual subscription reassignment activity and consider implementing additional access control checks on subscription management functions if possible.