Threats tagged 'ghsa-rwgq-cgw6-3p37'

PKP Open Journal Systems versions up to 3.5.0-5 contain an insecure direct object reference vulnerability that allows authorized journal or subscription managers to access and manipulate subscriptions of other journals by supplying arbitrary subscription IDs. This enables enumeration of subscriber details and reassignment of subscriptions, potentially revoking legitimate access.