{"id":"CVE-2026-113610","summary":"Xen Orchestra before 6.9.0 Authorization Bypass via user.set API","details":"Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.","aliases":["GHSA-mc4m-hc98-rhmv"],"modified":"2026-10-21T02:56:29.202263735Z","published":"2026-10-20T15:40:35.476Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113610.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"fixed":"6.9.0"}]}]},{"extracted_events":[{"strategy":"CPEApplicability","range":[{"fixed":"6.9.0"}],"source":"CPE_FIELD"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"6.9.0"}]}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113610.json"},{"type":"PACKAGE","url":"https://github.com/vatesfr/xen-orchestra"},{"type":"ARTICLE","url":"https://github.com/vatesfr/xen-orchestra/blob/f187b7931988e3e5c9ccd58abe730d6b006cc246/packages/xo-server/src/api/user.mjs#L73-L93"},{"type":"FIX","url":"https://github.com/vatesfr/xen-orchestra/commit/3dbf8738f1e682b96ade2074dc84bee02a0c2d48"},{"type":"ADVISORY","url":"https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113610"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-authorization-bypass-via-user-set-api"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vatesfr/xen-orchestra","events":[{"introduced":"0"},{"fixed":"3dbf8738f1e682b96ade2074dc84bee02a0c2d48"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"3dbf8738f1e682b96ade2074dc84bee02a0c2d48"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["xo-lite-v0.25.0","xo-lite-v0.24.0","xo-lite-v0.23.0","xo-lite-v0.22.0","xo-lite-v0.21.0","xo-lite-v0.20.0","xo-lite-v0.19.0","xo-lite-v0.18.0","xo-lite-v0.17.0","xo-lite-v0.16.0","xo-lite-v0.15.0","xo-lite-v0.14.1","xo-lite-v0.14.0","xo-lite-v0.13.1","xo-lite-v0.13.0","xo-lite-v0.12.1","xo-lite-v0.12.0","xo-lite-0.12.0","xo-lite-v0.11.0","xo-lite-v0.10.1","xo-lite-v0.10.0","xo-lite-v0.9.1","xo-lite-v0.9.0","xo-lite-v0.8.0","xo-lite-v0.7.1","xo-lite-v0.7.0","xo-lite-v0.6.0","xo-lite-v0.5.0","xo-lite-v0.4.0","xo-lite-v0.2.7","xo-lite-v0.2.3","xo-lite-v0.2.2","xo-lite-v0.2.1","xo-lite-v0.2.0","xo-lite-v0.1.6","xo-lite-v0.1.5","xo-lite-v0.1.4","xo-lite-v0.1.3","xo-web-v5.50.3","xo-web-v5.50.2","@xen-orchestra/log-v0.2.0","xo-web-v5.50.0","xo-server-v5.50.0","@xen-orchestra/template-v0.1.0","xo-server-sdn-controller-v0.3.0","@xen-orchestra/cron-v1.0.4","xo-web-v5.49.0","xo-server-v5.49.0","xo-server-sdn-controller-v0.2.1","xo-web-v5.48.1","xo-server-sdn-controller-v0.2.0","xo-web-v5.48.0","xo-server-v5.48.0","xo-server-sdn-controller-v0.1.3","xo-web-v5.47.0","xo-server-v5.47.0","xo-server-usage-report-v0.7.3","xo-server-sdn-controller-v0.1.2","xo-web-v5.46.0","xo-server-v5.46.0","xo-server-v5.45.3","@xen-orchestra/fs-v0.10.1","xo-server-v5.45.2","xen-api-v0.27.1","xo-web-v5.45.1","xo-server-v5.45.1","xo-web-v5.44.0","xo-server-v5.44.0","xo-server-backup-reports-v0.16.2","xo-server-auth-saml-v0.6.0","xo-server-sdn-controller-v0.1.0","xen-api-v0.26.0","xo-server-auth-ldap-v0.6.5","xo-web-v5.43.0","xo-server-v5.43.0","xen-api-v0.25.2","xo-web-v5.42.1","xo-server-v5.42.1","xo-web-v5.42.0","xo-server-v5.42.0","xo-web-v5.41.0","xo-server-v5.41.0","vhd-lib-v0.7.0","@xen-orchestra/fs-v0.9.0","xo-server-backup-reports-v0.16.1","xo-web-v5.40.1","xo-web-v5.40.0","xo-server-v5.40.0","complex-matcher-v0.6.0","xo-server-backup-reports-v0.16.0","xo-web-v5.39.1","xo-web-v5.39.0","xo-server-v5.39.0","vhd-lib-v0.6.1","xo-vmdk-to-vhd-v0.1.7","xen-api-v0.25.1","xo-server-v5.38.1","xen-api-v0.25.0","xo-web-v5.38.0","xo-server-v5.38.0","xo-server-usage-report-v0.7.2","@xen-orchestra/fs-v0.8.0","vhd-lib-v0.6.0","xen-api-v0.24.6","xo-web-v5.37.0","xo-server-v5.37.0","xo-server-auth-google-v0.2.1","vhd-cli-v0.3.0","xo-server-v5.36.3","xen-api-v0.24.5","xo-server-v5.36.2","xen-api-v0.24.4","xo-server-v5.36.1","xo-server-v5.35.1","fs-v0.7.1","xo-server-v5.36.0","xen-api-v0.24.3","xo-web-v5.35.0","xo-server-v5.35.0","xo-server-auth-saml-v0.5.3","fs-v0.6.1","xen-api-v0.24.2","xo-server-v5.34.1","xo-web-v5.34.0","xo-server-v5.34.0","xo-vmdk-to-vhd-v0.1.6","xen-api-v0.24.1","vhd-lib-v0.5.1","xo-web-v5.33.0","xo-server-v5.33.0","fs-v0.6.0","xen-api-v0.24.0","vhd-cli-v0.2.0","vhd-lib-v0.5.0","xo-server-v5.32.2","xo-web-v5.32.1","xo-server-v5.32.1","xo-web-v5.32.0","xo-server-v5.32.0","xo-acl-resolver-v0.4.1","xen-api-v0.23.0","fs-v0.5.0","xo-server-v5.31.1","xo-web-v5.31.0","xo-server-v5.31.0","xo-server-usage-report-v0.7.1","xo-server-perf-alert-v0.2.0","xen-api-v0.22.0","xo-server-v5.30.1","xo-web-v0.30.0","xo-server-v0.30.0","xo-acl-resolver-v0.4.0","xo-common-v0.2.0","xen-api-v0.21.0","xo-web-v5.29.3","xo-server-v5.29.4","xo-web-v5.29.2","xo-server-v5.29.3","fs-v0.4.1","xo-web-v5.29.1","xo-server-v5.29.2","log-v0.1.4","xo-server-v5.29.1","log-v0.1.2","log-v0.1.1","xo-web-v5.29.0","xo-server-v5.29.0","xo-server-usage-report-v0.7.0","xen-api-v0.20.0","vhd-lib-v0.4.0","complex-matcher-v0.5.0","fs-v0.4.0","log-v0.1.0","xo-common-v0.1.2","xo-server-backup-reports-v0.15.0","xo-web-v5.28.0","xo-server-v5.28.0","xo-acl-resolver-v0.3.0","xo-server-usage-report-v0.6.0","xo-vmdk-to-vhd-v0.1.5","vhd-lib-v0.3.2","cr-seed-cli-v0.2.0","xo-web-v5.27.1","xo-server-v5.27.2","xo-vmdk-to-vhd-v0.1.4","vhd-lib-v0.3.1","fs-v0.3.1","xo-server-v5.27.1","xen-api-v0.19.0","xo-web-v5.27.0","xo-server-v5.27.0","mixin-v0.0.0","emit-async-v0.0.0","defined-v0.0.0","xo-server-backup-reports-v0.14.0","async-map-v0.0.0","xo-web-v5.26.0","xo-server-v5.26.0","xo-web-v5.25.1","xo-server-v5.25.2","xo-server-v5.25.1","xo-web-v5.25.0","xo-server-v5.25.0","fs-v0.3.0","xo-server-backup-reports-v0.13.0","xen-api-v0.18.0","xo-server-v5.24.2","xen-api-v0.17.1","xo-server-v5.24.1","xo-server-cloud-v0.2.4","xo-server-cloud-v0.2.3","xo-web-v5.24.0","xo-server-v5.24.0","fs-v0.2.1","xen-api-v0.17.0","xo-web-v5.23.0","xo-server-v5.23.0","xo-server-backup-reports-v0.12.3","complex-matcher-v0.4.0","xo-remote-parser-v0.5.0","xen-api-v0.16.12","xo-web-v5.22.1","xo-web-v5.22.0","xo-server-v5.22.0","vhd-cli-v0.1.0","vhd-lib-v0.3.0","fs-v0.2.0","xo-remote-parser-v0.4.0","xo-web-v5.21.0","xo-server-v5.21.0","xo-server-load-balancer-v0.3.2","xen-api-v0.16.11","vhd-lib-v0.2.0","xo-server-v5.20.3","vhd-lib-v0.1.3","xo-server-v5.20.2","xo-web-v5.20.2","xo-server-v5.20.1","xo-vmdk-to-vhd-v0.1.3","xo-server-backup-reports-v0.12.2","xen-api-v0.16.10","vhd-lib-v0.1.2","fs-v0.1.0","xo-server-backup-reports-v0.12.1","xo-web-v5.20.1","xo-web-v5.20.0","xo-server-v5.20.0","xo-server-usage-report-v0.5.0","xo-server-backup-reports-v0.12.0","xo-acl-resolver-v0.2.4","vhd-lib-v0.1.1","fs-v0.0.1","xo-server-v5.19.9","xo-web-v5.19.8","xo-vmdk-to-vhd-v0.1.2","xo-server-v5.19.8","xo-web-v5.19.6","vhd-lib-v0.1.0","xo-server-v5.19.7","xo-web-v5.19.5","xo-vmdk-to-vhd-v0.1.1","xo-server-v5.19.6","xo-web-v5.19.4","xo-web-v5.19.3","xo-server-v5.19.5","xo-web-v5.19.2","xo-server-v5.19.4","xo-vmdk-to-vhd-v0.1.0","xo-server-backup-reports-v0.11.0","vhd-lib-v0.0.0","vhd-cli-v0.0.1","fs-v0.0.0","xo-web-v5.19.1","xo-server-v5.19.3","xo-server-v5.19.2","xo-server-v5.19.1","xo-web-v5.19.0","xo-server-v5.19.0","xo-server-perf-alert-v0.1.0","xo-server-auth-saml-v0.5.2","xo-server-usage-report-v0.4.2","xo-server-usage-report-v0.4.1","xo-web-v5.18.3","xo-web-v5.18.2","xo-server-v5.18.3","xen-api-v0.16.9","xo-server-v5.18.2","xo-web-v5.18.1","xo-server-v5.18.1","xen-api-v0.16.8","cron-v1.0.3","xo-web-v5.18.0","xo-server-v5.18.0","xo-server-usage-report-v0.4.0","xo-server-auth-saml-v0.5.1","xen-api-v0.16.7","xo-web-v5.17.3","xo-server-v5.17.4","xo-web-v5.17.2","xo-server-v5.17.3","xo-server-v5.17.2","xo-web-v5.17.1","xo-server-v5.17.1","xo-web-v5.17.0","xo-server-v5.17.0","complex-matcher-v0.3.0","xo-server-v5.16.2","xen-api-v0.16.6","cron-v1.0.2","cron-v1.0.1","xo-server-v5.16.1","xo-web-v5.16.2","value-matcher-v0.2.0","xo-server-backup-reports-v0.10.0","xen-api-v0.16.5","cron-v1.0.0","xo-web-v0.16.1","xo-server-cloud-v0.2.2","cron-v0.2.0","cron-v0.1.2","cron-v0.1.1","cron-v0.1.0","value-matcher-v0.1.0","xen-api-v0.16.4","complex-matcher-v0.2.1","complex-matcher-v0.2.0","xen-api-v0.16.3","xen-api-v0.16.2","xen-api-v0.16.1","complex-matcher-v0.1.1","complex-matcher-v0.1.0","xen-api-v0.16.0","xo-server-transport-email-v0.5.0","xo-server-auth-saml-v0.5.0","xo-server-auth-ldap-v0.6.4","xo-cli-v0.10.1","xo-server-backup-reports-v0.9.1","xo-server-backup-reports-v0.9.0","xen-api-v0.15.1","xen-api-v0.15.0","xo-cli-v0.10.0","xen-api-v0.14.3","xo-cli-v0.9.1","xo-cli-v0.9.0","xo-cli-v0.8.4","xo-lib-v0.9.0","xo-server-transport-email-v0.3.3","xo-server-auth-ldap-v0.6.2","xo-server-auth-ldap-v0.6.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113610.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}