CVE-2026-113610
Received Received - Intake

Authorization Bypass in Xen Orchestra Allows Privilege Escalation

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113610
EUVD
EUVD-2026-105088

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vatesfr xen-orchestra 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113610 is an authorization bypass vulnerability in Xen Orchestra versions before 6.9.0. It allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user ID through the user.set API method. Attackers can delete or corrupt TOTP secrets to disable two-factor authentication or block logins, and overwrite stored credentials like xsCredentials and sshKeys.

Detection Guidance

Check Xen Orchestra version with npm list -g @xen-orchestra/xo-server or xo-server --version. Inspect API logs for unauthorized user.set calls or modifications to preferences.otp, xsCredentials, or sshKeys. Monitor for unexpected TOTP secret deletions or credential overwrites.

Impact Analysis

This vulnerability allows attackers with low privileges to escalate their access, disable security features like 2FA, cause permanent login denial-of-service, or steal sensitive credentials. It could lead to full compromise of the Xen Orchestra server, unauthorized control over virtualization environments, and potential data breaches or system takeovers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain adequate access controls, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade Xen Orchestra to version 6.9.0 or later immediately. Revoke any suspicious user sessions or credentials. Review logs for past unauthorized changes. Implement network segmentation to limit access to the XO server API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart