Open Journal Systems CVE-2026-111609

Requires an authenticated account holding journal-manager or subscription-manager privileges (PR:H) on at least one journal, and realistically a multi-journal OJS installation so that other journals' subscription records exist to target. Exploitation is performed against the editSubscription endpoint (to enumerate and view arbitrary sequential subscription IDs) and the updateSubscription endpoint (to reassign subscriptions across journals) in OJS versions through 3.5.0-5. Limiting factors: the required privileged role means this is not exploitable by anonymous or ordinary-reader accounts, and impact is confined to subscription data (disclosure and reassignment) with no direct system compromise; single-journal deployments have little to cross-reference and therefore reduced exposure.

This is a medium-severity authorization flaw (CWE-639, IDOR) whose risk signals are internally consistent and point to a limited, scoped threat rather than a mass-exploitation priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N, score 5.1) is credible: exploitation is network-reachable and low-complexity, but requires PR:H - a legitimately provisioned journal-manager or subscription-manager account - which is the single largest limiting factor and the reason this is not a critical issue. No EPSS score, KEV listing, or exploit-code flag was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact is partial (VC:L/VI:L): disclosure of other journals' subscriber details and tampering by reassigning subscriptions, but no availability impact to the system itself and no scope change to other components. The main caveat is the trust model: in single-tenant OJS installs the PR:H requirement makes this low-consequence, but in large multi-journal hosted platforms (where many independent editors each hold manager rights over their own journal) this becomes a meaningful cross-tenant isolation break. The 'Authentication Bypass' tag is misleading - this is an authorization/IDOR defect, not an authentication bypass, since a valid privileged session is a prerequisite.

An attacker who controls a journal-manager or subscription-manager account on one journal of a shared multi-journal OJS platform iterates sequential subscription IDs through the editSubscription endpoint to read subscriber records belonging to other journals, then calls updateSubscription to reassign a victim's subscription to their own journal, revoking the legitimate subscriber's access. No public exploit code was identified in the input, though a technical write-up and the vulnerable source lines are publicly referenced, lowering the barrier to reproduction.