Genealogy, a family tree PHP application, contains a critical broken access control flaw in the TeamController::transferOwnership method that allows any authenticated user to transfer ownership of non-personal teams to themselves. This flaw permits a user to take over another user’s team workspace and gain unrestricted access to all genealogy data tied to the compromised team. The vulnerability is classified as CWE-862 (Broken Access Control).

The vulnerability affects the MGeurts Genealogy application prior to version 5.9.1. Any authenticated user who can access the application can exploit the flaw, regardless of their role or the team’s ownership status.

The CVSS score of 10 indicates that an attacker could fully compromise a team’s data and functionality. The EPSS score of less than 1% suggests that while the vulnerability is severe, current evidence of exploitation is low, possibly due to a narrow window before the patch. It is not currently listed in CISA’s KEV catalog. The likely attack vector is an authenticated web request to the transferOwnership endpoint; therefore, any legitimate user with a valid session can trigger the exploit if no additional safeguards are in place.