CVE-2026-113610

MediumCVSS 5.4

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.

Risk Assessment

An attacker can disable two-factor authentication or block other users' logins, and overwrite credentials and SSH keys. This can lead to account takeover and unauthorized access to infrastructure.

Recommendation

Update Xen Orchestra to version 6.9.0 or later. Verify MFA and SSH key configurations after the update.

Other vulnerabilities in Xen Orchestra

CVE-2026-110111High
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS