CVE-2026-39355 MGeurts CVE debrief

Who should care

Users of Genealogy PHP application version prior to 5.9.1 should update to 5.9.1 to prevent exploitation. System administrators and security teams responsible for Genealogy installations should prioritize patching. The Genealogy PHP application, prior to version 5.9.1, contains a critical broken access control vulnerability. This vulnerability, tracked as CVE-2026-39355, allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves.

Technical summary

The Genealogy PHP application, prior to version 5.9.1, contains a critical broken access control vulnerability. This vulnerability, tracked as CVE-2026-39355, allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users' team workspaces and unrestricted access to all genealogy data associated with the compromised team. The vulnerability is characterized by a CVSS score of 9.9 and a severity of CRITICAL. The vulnerability is addressed in version 5.9.1 of the Genealogy application.

Defensive priority

High priority should be given to patching Genealogy installations, as the vulnerability allows for significant exploitation with a CVSS score of 9.9. System administrators and security teams responsible for Genealogy installations should prioritize patching.

Recommended defensive actions

• Update Genealogy to version 5.9.1 or later
• Review team ownership and genealogy data access controls
• Monitor for suspicious team ownership transfer activities
• Implement additional access controls and monitoring for Genealogy workspaces
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-04-07T19:16:46.523Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The Genealogy PHP application, prior to version 5.9.1, contains a critical broken access control vulnerability. This vulnerability, tracked as CVE-2026-39355, allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users' team workspaces and unrestricted access to all genealogy data associated with the compromised team. The vulnerability is characterized by a CVSS score of 9.9 and a severity of CRITICAL. The vulnerability is addressed in version 5.9.1 of the Genealogy application.

Official resources