What is the CVSS score of CVE-2026-39355?

CVE-2026-39355 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39355?

Genealogy PHP versions before 5.9.1 contain a critical access control flaw allowing any authenticated user to seize control of team workspaces and the genealogical data within them.. A patch is available.

How to fix or mitigate CVE-2026-39355?

Within 24 hours: Identify all systems running Genealogy PHP and confirm current version numbers. Within 7 days: Upgrade all instances to version 5.9.1 or later; if immediate patching is not feasible, implement network-level access restrictions to limit authenticated user base. Within 30 days: Conduct audit of team workspace ownership changes and genealogical data access logs post-deployment to detect unauthorized transfers; reset credentials for all users with elevated team management privileges.

PHP CVE-2026-39355

EUVD-2026-19865 CRITICAL

Missing Authorization (CWE-862)

2026-04-07 security-advisories@github.com

PHP Authentication Bypass

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.9.1

EUVD ID Assigned

Apr 07, 2026 - 19:22 euvd

EUVD-2026-19865

Analysis Generated

Apr 07, 2026 - 19:22 vuln.today

CVE Published

Apr 07, 2026 - 19:16 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users’ team workspaces and unrestricted access to all genealogy data associated with the compromised team. This vulnerability is fixed in 5.9.1.

AnalysisAI

Authenticated users can hijack arbitrary team workspaces in Genealogy PHP application versions before 5.9.1 through broken access control, enabling complete takeover of genealogy data belonging to other users. The vulnerability requires only low-privilege authentication (PR:L) with network access (AV:N) and low attack complexity (AC:L), allowing any authenticated user to transfer ownership of non-personal teams to themselves. No public exploit code has been identified at time of analysis, though the straightforward access control flaw and detailed GitHub security advisory make exploitation highly feasible for authenticated attackers.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a class of access control flaws where the application fails to properly verify that authenticated users have permission to perform privileged actions. In the Genealogy PHP application's team management functionality, the ownership transfer mechanism lacks proper authorization checks to validate that the requesting user has rights to modify team ownership. This allows any authenticated user-regardless of their role or relationship to a team-to invoke ownership transfer operations on teams they should not control. The scope change indicator (S:C) in the CVSS vector suggests the vulnerability enables crossing security boundaries, as attackers can pivot from their own user context to gain control over other users' isolated team workspaces. PHP applications commonly implement role-based access control through session management and database queries; this flaw indicates missing or improperly implemented permission validation before executing ownership modification database operations.

RemediationAI

Upgrade the Genealogy PHP application to version 5.9.1 or later, which contains the vendor-released patch addressing the broken access control vulnerability. Administrators should deploy this update immediately to all production instances. The fix is available through the official GitHub repository at https://github.com/MGeurts/genealogy, with detailed security advisory information at https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4. Following upgrade, conduct an audit of team ownership records to identify any unauthorized ownership transfers that may have occurred while systems were vulnerable, as historical exploitation could persist through compromised team structures. Review application access logs for unusual team modification activity prior to patching. As an interim measure before patching, consider restricting authenticated user access or disabling team management functionality if operationally feasible, though upgrading to 5.9.1 remains the only complete remediation.