CVE-2026-39355

CVE-2026-39355 is a critical broken access control vulnerability affecting Genealogy (a PHP-based family tree application) prior to version 5.9.1. The flaw allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves, enabling complete takeover of other users' team workspaces and unrestricted access to sensitive genealogy data. This vulnerability was remediated in version 5.9.1. The vulnerability presents a HIGH severity risk with a CVSS score of 8.8, requiring only network access and low privileges (authenticated user status) to exploit, with no user interaction necessary. The attack has high impact across all three CIA triad dimensions: confidentiality (unauthorized data access), integrity (unauthorized ownership transfer), and availability (potential denial of legitimate users' access). The broad scope and low barriers to exploitation make this a significant risk for organizations using affected versions. There is currently no evidence of active exploitation in the wild, with the vulnerability absent from the CISA Known Exploited Vulnerabilities (KEV) catalog and showing no presence on exploit databases or hot lists. However, the relatively high FAUCET Risk Score of 52.0/100 and the straightforward nature of the vulnerability suggest that organizations should prioritize patching to version 5.9.1 proactively rather than waiting for evidence of active exploitation.