CVE-2026-113610 in Xen Orchestra
Summary
by MITRE • 10/20/2026
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Xen Orchestra versions prior to 6.9.0 represents a critical authorization bypass within the xo-server component, specifically targeting the user.set API method. This flaw stems from insufficient access control mechanisms that fail to validate whether an authenticated user possesses the necessary privileges to modify data belonging to other users. In a properly secured system, any request to update user attributes should be strictly bound to the identity of the requester or require elevated administrative rights if modifying another entity's profile. However, in this implementation, the API endpoint accepts arbitrary target user identifiers without performing adequate authorization checks against the session context of the calling user. This architectural deficiency allows low-privileged authenticated users to act as higher-privilege entities regarding specific data manipulation operations, effectively bypassing the intended role-based access control model.
The operational impact of this vulnerability is severe due to the sensitive nature of the attributes that can be manipulated through this flaw. An attacker with a standard user account can exploit this weakness to alter critical security configurations associated with other users in the system. Most notably, the ability to delete or corrupt the preferences.otp field allows an adversary to disable two-factor authentication for targeted accounts. By removing the Time-based One-Time Password secret, the attacker strips away a vital layer of defense-in-depth, leaving those accounts vulnerable solely to password guessing attacks. Furthermore, by intentionally corrupting this value, an attacker can cause denial-of-service conditions that lock legitimate users out of their own accounts, disrupting operational continuity and potentially masking other malicious activities as routine system errors or maintenance issues.
Beyond authentication mechanisms, the vulnerability extends to the manipulation of stored credentials and secure shell keys. The xo-server API permits overwriting xsCredentials and sshKeys fields for arbitrary user IDs. This capability enables an attacker to inject their own SSH public key into a victim's profile, granting persistent remote access without needing valid login credentials in many configurations. Similarly, modifying xsCredentials can allow the attacker to hijack active sessions or escalate privileges by assuming the identity of high-privilege administrators within the Xen Orchestra environment. Such actions compromise the confidentiality and integrity of the entire virtualization management infrastructure, as control over administrative accounts typically grants access to all managed hosts, VMs, and network configurations.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Escalation and CWE-862 Missing Authorization, reflecting its core nature as an access control failure where users are permitted actions that exceed their assigned privileges. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, specifically the sub-technique of using legitimate credentials with unauthorized permissions, and potentially T1539 Steal Web Session Cookie if session hijacking is facilitated through credential manipulation. The exploitation path relies on authenticated access, meaning that while it does not require unauthenticated remote code execution, it poses a significant risk in environments where internal network segmentation or user trust levels are assumed to be secure boundaries.
Mitigation strategies must prioritize immediate patching of the Xen Orchestra installation to version 6.9.0 or later, which addresses these authorization checks within the xo-server module. For organizations unable to apply patches immediately due to operational constraints, temporary mitigations should include restricting network access to the XO management interface to only trusted administrative subnets and enforcing strict firewall rules that limit exposure of API endpoints. Additionally, implementing robust monitoring for anomalous changes in user profiles, particularly sudden modifications to OTP settings or SSH keys by non-administrative accounts, can aid in early detection of exploitation attempts. Security teams should also enforce strong password policies and consider additional layers of authentication such as hardware security keys to reduce the impact if an account is compromised via this vector. Regular audits of API access logs for unauthorized modification patterns are essential to maintain visibility into potential abuse of these endpoints until permanent fixes are deployed across all affected instances.