CVE-2026-39355
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Genealogy is a family tree PHP application. Prior to version 5.9.1, a critical broken access control vulnerability allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users' team workspaces and unrestricted access to all genealogy data associated with the compromised team.
Risk Assessment
The organization risks complete loss of control over genealogy data and takeover of team accounts by unauthorized users, potentially leading to leakage of sensitive information.
Recommendation
Immediately update the Genealogy application to version 5.9.1 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users’ team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1.