{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39355", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T21:29:17.349Z", "datePublished": "2026-04-07T18:56:06.385Z", "dateUpdated": "2026-04-08T18:10:34.141Z"}, "containers": {"cna": {"title": "Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4"}], "affected": [{"vendor": "MGeurts", "product": "genealogy", "versions": [{"version": "< 5.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T18:56:06.385Z"}, "descriptions": [{"lang": "en", "value": "Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users\u2019 team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1."}], "source": {"advisory": "GHSA-2rq7-jqm7-w8x4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T18:10:30.678440Z", "id": "CVE-2026-39355", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T18:10:34.141Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)", "source": {"advisory": "GHSA-2rq7-jqm7-w8x4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MGeurts", "product": "genealogy", "versions": [{"status": "affected", "version": "< 5.9.1"}]}], "references": [{"url": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4", "name": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users\u2019 team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T18:56:06.385Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39355", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T18:10:30.678440Z"}}}], "references": [{"url": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-08T18:10:24.750Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-39355", "state": "PUBLISHED", "dateUpdated": "2026-04-07T18:56:06.385Z", "dateReserved": "2026-04-06T21:29:17.349Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T18:56:06.385Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users\u2019 team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1."}], "id": "CVE-2026-39355", "lastModified": "2026-04-08T19:25:25.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-07T19:16:46.523", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.9.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "genealogy", "source": "cna", "vendor": "MGeurts"}, "product": "genealogy", "vendor": "mgeurts"}], "analysis": {"en": {"generated_at": "2026-04-07T22:42:47.172175+00:00", "value": {"mitigation_remediation": ["Upgrade Genealogy to version 5.9.1 or later."], "summary": {"action": "Patch Immediately", "impact": "Complete takeover of any team by an authenticated user"}, "threat_synthesis": {"affected_systems": "All installations of Genealogy built by MGeurts with versions prior to 5.9.1 are affected. Any user who has successfully logged into the application can exploit the transferOwnership endpoint to hijack teams owned by other users.", "description_and_impact": "A critical access control flaw in the TeamController::transferOwnership() method of the Genealogy PHP application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This grants the attacker full control over the target team\u2019s workspace, giving unrestricted read and write access to all genealogy data associated with that team.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 10, indicating the highest severity. Exploitation is straightforward, requiring only valid user credentials and no additional preconditions. While no EPSS data is available, the ease of exploitation by any authenticated user suggests a high likelihood of abuse. The defect is not listed in the CISA KEV catalog, but its impact warrants immediate attention."}}}}, "created": "2026-04-08T19:34:53.255359+00:00", "updated": "2026-04-08T19:46:31.307280+00:00", "vendors": ["mgeurts", "mgeurts$PRODUCT$genealogy"]}