Live › vulnerability › CVE-2026-113610
Go to dashboardXen Orchestra's xo-server user.set API method does not check that the caller owns the target user id, so any authenticated low-privileged user can change other accounts. An attacker can delete another user's TOTP secret to turn off two-factor authentication, corrupt it to lock them out, or overwrite stored xsCredentials and SSH keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Xen Orchestra (xo-server) before 6.9.0 where more than one user has an account. Exposure depends on having an authenticated low-privileged account, so single-admin installations are less exposed. unknown whether managed or hosted Xen Orchestra instances are included.
No product ranges from the sources yet.
6.9.06.9.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.
This page as .md · .json · in your agent: get_signal("CVE-2026-113610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.