PKP Open Journal Systems contains an insecure direct object reference, allowing the handling of arbitrary subscription identifiers. The flaw enables a journal or subscription manager to view subscriber details of other journals and to reassign those subscriptions to their own journal, effectively revoking legitimate access. This vulnerability is classified as CWE-639, indicating a weak or missing authorization check that leads to exposure of sensitive data and unauthorized modification of application state.

All installations of PKP Open Journal Systems through version 3.5.0‑5 are affected. The issue resides in the subscription editing and updating components of the system, and no other product versions or vendors are listed as impacted.

The CVSS score of 5.1 indicates moderate severity, and the lack of an EPSS value and absence from the CISA KEV catalog suggest that exploitation is currently uncommon or untracked. The most likely attack vector is an authorized manager or user with subscription‑level permissions who can supply arbitrary subscription IDs; enumeration of sequential IDs can expose subscriber information, and updateSubscription can move subscriptions across journals. Given this authorized context, the risk is significant for organizations that rely on accurate subscription ownership or confidentiality of subscriber details.