Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113610Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in xen-orchestra from vatesfr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.

Affected products (as reported)

Vendor	Product	Versions
vatesfr	xen-orchestra	0 – before 6.9.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-mc4m-hc98-rhmv) vendor-advisory
https://github.com/vatesfr/xen-orchestra/commit/3dbf8738f1e682b96ade2074dc84bee02a0c2d48 patch
https://github.com/vatesfr/xen-orchestra/blob/f187b7931988e3e5c9ccd58abe730d6b006cc246/packages/xo-server/src/api/user.mjs#L73-L93 technical-description
VulnCheck Advisory: Xen Orchestra before 6.9.0 Authorization Bypass via user.set API third-party-advisory