Read the docs
TI-2026-76939 Aliases CVE-2026-113610GHSA-22x8-669x-gh7m

Authorization bypass in Xen Orchestra user.set API lets users alter others

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Xen Orchestra before 6.9.0 contains an authorization bypass in the xo-server user.set API method. A low-privileged authenticated user can modify other users' preferences by supplying an arbitrary target user id (CWE-639). An attacker can delete the TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored credentials and SSH keys.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed xen-orchestra (vatesfr): 6.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vatesfrxen-orchestrabefore 6.9.06.9.0Patch availableCNA
  • xen-orchestra Vendorvatesfr Affected before 6.9.0 Fixed in 6.9.0 Patch available CNA

Remediation

Update Xen Orchestra to version 6.9.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA xen-orchestra (vatesfr) Fixed in 6.9.0

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113610
  2. 2026-10-20 CISA SSVC decision points changed
  3. 2026-10-21 Alias added: GHSA-22x8-669x-gh7m

References

Patch 1

Advisory 1

Other 1

  • TI-2026-73416 Prototype pollution in Xen Orchestra enables privilege escalation CVSS 4.0HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences