Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-39355Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)

Critical 10.0

In plain English

A critical-severity missing authorization in genealogy from MGeurts. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users’ team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1.

Affected products (as reported)

Vendor	Product	Versions
MGeurts	genealogy	< 5.9.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4 x_refsource_CONFIRM