CVE-2026-111609: Open Journal Systems 0 through 3.5.0-5

Affected technology

Open Journal Systems · 0 through 3.5.0-5
PKP

Description’s affected range: through 3.5.0-5

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.