CVE-2026-113610: Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xen Orchestrato a version that resolves this vulnerability.Fixed in 6.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privileged authenticated Xen Orchestra account and network access to the affected xo-server API. No user interaction is required.
What can an attacker change through the vulnerable API?
The attacker can target another user's preferences by supplying that user's ID to user.set. They can delete or corrupt the preferences.otp TOTP secret, or overwrite stored xsCredentials and sshKeys.
Are deployments running Xen Orchestra 6.9.0 affected?
The issue affects Xen Orchestra versions before 6.9.0. Version 6.9.0 is not identified as affected by the provided information.
How can an organization check for possible impact?
Review user preference changes for unexpected modifications to preferences.otp, xsCredentials, and sshKeys, especially changes associated with low-privileged accounts acting on other users' IDs. Deleted or corrupted TOTP secrets may appear as disabled two-factor authentication or login failures.