Authorization Bypass in Xen Orchestra by Vates
CVE-2026-113610

5.3MEDIUM

Key Information:

Vendor

Vatesfr

Status
Xen Project-orchestra
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113610?

Xen Orchestra prior to version 6.9.0 exhibits an authorization bypass in the 'xo-server user.set' API method. This flaw enables low-privileged authenticated users to improperly alter the preferences of other users by specifying an arbitrary target user ID. Potentially malicious actions could include the removal of two-factor authentication (TOTP) secrets, preventing legitimate users from accessing their accounts, or overwriting sensitive credentials such as xsCredentials and sshKeys.

Affected Version(s)

xen-orchestra 0 < 6.9.0

References

https://github.com/vatesfr/xen-orchestra/security/advisor...
vendor-advisory
https://github.com/vatesfr/xen-orchestra/commit/3dbf8738f...
patch
https://github.com/vatesfr/xen-orchestra/blob/f187b793198...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Allan Victor
.