CVE-2026-39355 — AI Deep Analysis Summary

🚨 **Essence**: A critical Access Control flaw in Genealogy PHP app. <br>💥 **Consequences**: Attackers can hijack ownership of genealogy records belonging to other users. Total loss of data integrity and privacy.

🛡️ **Root Cause**: **CWE-862** (Missing Authorization). <br>🔍 **Flaw**: The application fails to verify if the current user has permission to modify records owned by others.…

👥 **Affected**: **MGeurts / KREAWEB.be** <br>📦 **Product**: Genealogy (PHP Application) <br>📉 **Version**: **Pre-5.9.1** (All versions before 5.9.1 are vulnerable).

💀 **Attacker Actions**: <br>1️⃣ **Take Ownership**: Transfer any genealogy record to their own account. <br>2️⃣ **Modify Data**: Edit or delete others' family trees.…

⚠️ **Threshold**: **LOW** for exploitation, but **MEDIUM** for access. <br>🔑 **Auth Required**: Yes (PR:L). The attacker must be a logged-in user. <br>🌐 **Network**: Remote (AV:N). <br>🎯 **Complexity**: Low (AC:L).…

🚫 **Public Exploit**: **No**. <br>📄 **PoC**: None available in the provided data. <br>🌍 **Wild Exploit**: Unlikely at this stage due to lack of public PoCs, but the flaw is trivial to exploit manually if authenticated.

🔍 **Self-Check**: <br>1️⃣ Check your **Genealogy version**. If < 5.9.1, you are at risk. <br>2️⃣ Review **Access Control Logic**: Can User A edit records owned by User B?…

✅ **Fixed**: **Yes**. <br>🔧 **Patch**: Upgrade to **Version 5.9.1** or later. <br>📢 **Source**: Official GitHub Security Advisory (GHSA-2rq7-jqm7-w8x4).

🛡️ **No Patch Workaround**: <br>1️⃣ **Disable Public Access**: Restrict app access to trusted IPs. <br>2️⃣ **Manual Audit**: Regularly check record ownership logs for anomalies.…

🔥 **Urgency**: **HIGH**. <br>📊 **CVSS**: **9.1** (Critical). <br>⚡ **Action**: **Patch Immediately**. Even though auth is required, the impact (S:C, C:H, I:H, A:H) is devastating for data integrity. Do not wait.