CVE-2026-39355CWE-862

Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)

Critical · published April 7, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users’ team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-07T18:56Z
EPSS history
Timeline
  • 07 APR 18:56Z
    Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)
    cvelistv5