CVE-2026-113610
- Source
- https://cve.org/CVERecord?id=CVE-2026-113610
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113610.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-113610
- Aliases
-
- GHSA-mc4m-hc98-rhmv
- Published
- 2026-10-20T15:40:35Z
- Modified
- 2026-10-21T02:56:29Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
- Details
-
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113610.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "6.9.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }, { "extracted_events": [ { "range": [ { "fixed": "6.9.0" } ], "source": "CPE_FIELD", "strategy": "CPEApplicability" } ] }, { "extracted_events": [ { "range": [ { "fixed": "6.9.0" } ], "source": "DESCRIPTION" } ] } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113610.json
- https://github.com/vatesfr/xen-orchestra
- https://github.com/vatesfr/xen-orchestra/blob/f187b7931988e3e5c9ccd58abe730d6b006cc246/packages/xo-server/src/api/user.mjs#L73-L93
- https://github.com/vatesfr/xen-orchestra/commit/3dbf8738f1e682b96ade2074dc84bee02a0c2d48
- https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv
- https://nvd.nist.gov/vuln/detail/CVE-2026-113610
- https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-authorization-bypass-via-user-set-api
Affected packages
Git / github.com/vatesfr/xen-orchestra
Affected ranges
- Type
- GIT
- Repo
- https://github.com/vatesfr/xen-orchestra
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "fixed": "3dbf8738f1e682b96ade2074dc84bee02a0c2d48" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
@xen-orchestra/cron-v1.*
@xen-orchestra/cron-v1.0.4
@xen-orchestra/fs-v0.*
@xen-orchestra/fs-v0.10.1
@xen-orchestra/fs-v0.8.0
@xen-orchestra/fs-v0.9.0
@xen-orchestra/log-v0.*
@xen-orchestra/log-v0.2.0
@xen-orchestra/template-v0.*
@xen-orchestra/template-v0.1.0
async-map-v0.*
async-map-v0.0.0
complex-matcher-v0.*
complex-matcher-v0.1.0
complex-matcher-v0.1.1
complex-matcher-v0.2.0
complex-matcher-v0.2.1
complex-matcher-v0.3.0
complex-matcher-v0.4.0
complex-matcher-v0.5.0
complex-matcher-v0.6.0
cr-seed-cli-v0.*
cr-seed-cli-v0.2.0
cron-v0.*
cron-v0.1.0
cron-v0.1.1
cron-v0.1.2
cron-v0.2.0
cron-v1.*
cron-v1.0.0
cron-v1.0.1
cron-v1.0.2
cron-v1.0.3
defined-v0.*
defined-v0.0.0
emit-async-v0.*
emit-async-v0.0.0
fs-v0.*
fs-v0.0.0
fs-v0.0.1
fs-v0.1.0
fs-v0.2.0
fs-v0.2.1
fs-v0.3.0
fs-v0.3.1
fs-v0.4.0
fs-v0.4.1
fs-v0.5.0
fs-v0.6.0
fs-v0.6.1
fs-v0.7.1
log-v0.*
log-v0.1.0
log-v0.1.1
log-v0.1.2
log-v0.1.4
mixin-v0.*
mixin-v0.0.0
value-matcher-v0.*
value-matcher-v0.1.0
value-matcher-v0.2.0
vhd-cli-v0.*
vhd-cli-v0.0.1
vhd-cli-v0.1.0
vhd-cli-v0.2.0
vhd-cli-v0.3.0
vhd-lib-v0.*
vhd-lib-v0.0.0
vhd-lib-v0.1.0
vhd-lib-v0.1.1
vhd-lib-v0.1.2
vhd-lib-v0.1.3
vhd-lib-v0.2.0
vhd-lib-v0.3.0
vhd-lib-v0.3.1
vhd-lib-v0.3.2
vhd-lib-v0.4.0
vhd-lib-v0.5.0
vhd-lib-v0.5.1
vhd-lib-v0.6.0
vhd-lib-v0.6.1
vhd-lib-v0.7.0
xen-api-v0.*
xen-api-v0.14.3
xen-api-v0.15.0
xen-api-v0.15.1
xen-api-v0.16.0
xen-api-v0.16.1
xen-api-v0.16.10
xen-api-v0.16.11
xen-api-v0.16.12
xen-api-v0.16.2
xen-api-v0.16.3
xen-api-v0.16.4
xen-api-v0.16.5
xen-api-v0.16.6
xen-api-v0.16.7
xen-api-v0.16.8
xen-api-v0.16.9
xen-api-v0.17.0
xen-api-v0.17.1
xen-api-v0.18.0
xen-api-v0.19.0
xen-api-v0.20.0
xen-api-v0.21.0
xen-api-v0.22.0
xen-api-v0.23.0
xen-api-v0.24.0
xen-api-v0.24.1
xen-api-v0.24.2
xen-api-v0.24.3
xen-api-v0.24.4
xen-api-v0.24.5
xen-api-v0.24.6
xen-api-v0.25.0
xen-api-v0.25.1
xen-api-v0.25.2
xen-api-v0.26.0
xen-api-v0.27.1
xo-acl-resolver-v0.*
xo-acl-resolver-v0.2.4
xo-acl-resolver-v0.3.0
xo-acl-resolver-v0.4.0
xo-acl-resolver-v0.4.1
xo-cli-v0.*
xo-cli-v0.10.0
xo-cli-v0.10.1
xo-cli-v0.8.4
xo-cli-v0.9.0
xo-cli-v0.9.1
xo-common-v0.*
xo-common-v0.1.2
xo-common-v0.2.0
xo-lib-v0.*
xo-lib-v0.9.0
xo-lite-0.*
xo-lite-0.12.0
xo-lite-v0.*
xo-lite-v0.1.3
xo-lite-v0.1.4
xo-lite-v0.1.5
xo-lite-v0.1.6
xo-lite-v0.10.0
xo-lite-v0.10.1
xo-lite-v0.11.0
xo-lite-v0.12.0
xo-lite-v0.12.1
xo-lite-v0.13.0
xo-lite-v0.13.1
xo-lite-v0.14.0
xo-lite-v0.14.1
xo-lite-v0.15.0
xo-lite-v0.16.0
xo-lite-v0.17.0
xo-lite-v0.18.0
xo-lite-v0.19.0
xo-lite-v0.2.0
xo-lite-v0.2.1
xo-lite-v0.2.2
xo-lite-v0.2.3
xo-lite-v0.2.7
xo-lite-v0.20.0
xo-lite-v0.21.0
xo-lite-v0.22.0
xo-lite-v0.23.0
xo-lite-v0.24.0
xo-lite-v0.25.0
xo-lite-v0.4.0
xo-lite-v0.5.0
xo-lite-v0.6.0
xo-lite-v0.7.0
xo-lite-v0.7.1
xo-lite-v0.8.0
xo-lite-v0.9.0
xo-lite-v0.9.1
xo-remote-parser-v0.*
xo-remote-parser-v0.4.0
xo-remote-parser-v0.5.0
xo-server-auth-google-v0.*
xo-server-auth-google-v0.2.1
xo-server-auth-ldap-v0.*
xo-server-auth-ldap-v0.6.1
xo-server-auth-ldap-v0.6.2
xo-server-auth-ldap-v0.6.4
xo-server-auth-ldap-v0.6.5
xo-server-auth-saml-v0.*
xo-server-auth-saml-v0.5.0
xo-server-auth-saml-v0.5.1
xo-server-auth-saml-v0.5.2
xo-server-auth-saml-v0.5.3
xo-server-auth-saml-v0.6.0
xo-server-backup-reports-v0.*
xo-server-backup-reports-v0.10.0
xo-server-backup-reports-v0.11.0
xo-server-backup-reports-v0.12.0
xo-server-backup-reports-v0.12.1
xo-server-backup-reports-v0.12.2
xo-server-backup-reports-v0.12.3
xo-server-backup-reports-v0.13.0
xo-server-backup-reports-v0.14.0
xo-server-backup-reports-v0.15.0
xo-server-backup-reports-v0.16.0
xo-server-backup-reports-v0.16.1
xo-server-backup-reports-v0.16.2
xo-server-backup-reports-v0.9.0
xo-server-backup-reports-v0.9.1
xo-server-cloud-v0.*
xo-server-cloud-v0.2.2
xo-server-cloud-v0.2.3
xo-server-cloud-v0.2.4
xo-server-load-balancer-v0.*
xo-server-load-balancer-v0.3.2
xo-server-perf-alert-v0.*
xo-server-perf-alert-v0.1.0
xo-server-perf-alert-v0.2.0
xo-server-sdn-controller-v0.*
xo-server-sdn-controller-v0.1.0
xo-server-sdn-controller-v0.1.2
xo-server-sdn-controller-v0.1.3
xo-server-sdn-controller-v0.2.0
xo-server-sdn-controller-v0.2.1
xo-server-sdn-controller-v0.3.0
xo-server-transport-email-v0.*
xo-server-transport-email-v0.3.3
xo-server-transport-email-v0.5.0
xo-server-usage-report-v0.*
xo-server-usage-report-v0.4.0
xo-server-usage-report-v0.4.1
xo-server-usage-report-v0.4.2
xo-server-usage-report-v0.5.0
xo-server-usage-report-v0.6.0
xo-server-usage-report-v0.7.0
xo-server-usage-report-v0.7.1
xo-server-usage-report-v0.7.2
xo-server-usage-report-v0.7.3
xo-server-v0.*
xo-server-v0.30.0
xo-server-v5.*
xo-server-v5.16.1
xo-server-v5.16.2
xo-server-v5.17.0
xo-server-v5.17.1
xo-server-v5.17.2
xo-server-v5.17.3
xo-server-v5.17.4
xo-server-v5.18.0
xo-server-v5.18.1
xo-server-v5.18.2
xo-server-v5.18.3
xo-server-v5.19.0
xo-server-v5.19.1
xo-server-v5.19.2
xo-server-v5.19.3
xo-server-v5.19.4
xo-server-v5.19.5
xo-server-v5.19.6
xo-server-v5.19.7
xo-server-v5.19.8
xo-server-v5.19.9
xo-server-v5.20.0
xo-server-v5.20.1
xo-server-v5.20.2
xo-server-v5.20.3
xo-server-v5.21.0
xo-server-v5.22.0
xo-server-v5.23.0
xo-server-v5.24.0
xo-server-v5.24.1
xo-server-v5.24.2
xo-server-v5.25.0
xo-server-v5.25.1
xo-server-v5.25.2
xo-server-v5.26.0
xo-server-v5.27.0
xo-server-v5.27.1
xo-server-v5.27.2
xo-server-v5.28.0
xo-server-v5.29.0
xo-server-v5.29.1
xo-server-v5.29.2
xo-server-v5.29.3
xo-server-v5.29.4
xo-server-v5.30.1
xo-server-v5.31.0
xo-server-v5.31.1
xo-server-v5.32.0
xo-server-v5.32.1
xo-server-v5.32.2
xo-server-v5.33.0
xo-server-v5.34.0
xo-server-v5.34.1
xo-server-v5.35.0
xo-server-v5.35.1
xo-server-v5.36.0
xo-server-v5.36.1
xo-server-v5.36.2
xo-server-v5.36.3
xo-server-v5.37.0
xo-server-v5.38.0
xo-server-v5.38.1
xo-server-v5.39.0
xo-server-v5.40.0
xo-server-v5.41.0
xo-server-v5.42.0
xo-server-v5.42.1
xo-server-v5.43.0
xo-server-v5.44.0
xo-server-v5.45.1
xo-server-v5.45.2
xo-server-v5.45.3
xo-server-v5.46.0
xo-server-v5.47.0
xo-server-v5.48.0
xo-server-v5.49.0
xo-server-v5.50.0
xo-vmdk-to-vhd-v0.*
xo-vmdk-to-vhd-v0.1.0
xo-vmdk-to-vhd-v0.1.1
xo-vmdk-to-vhd-v0.1.2
xo-vmdk-to-vhd-v0.1.3
xo-vmdk-to-vhd-v0.1.4
xo-vmdk-to-vhd-v0.1.5
xo-vmdk-to-vhd-v0.1.6
xo-vmdk-to-vhd-v0.1.7
xo-web-v0.*
xo-web-v0.16.1
xo-web-v0.30.0
xo-web-v5.*
xo-web-v5.16.2
xo-web-v5.17.0
xo-web-v5.17.1
xo-web-v5.17.2
xo-web-v5.17.3
xo-web-v5.18.0
xo-web-v5.18.1
xo-web-v5.18.2
xo-web-v5.18.3
xo-web-v5.19.0
xo-web-v5.19.1
xo-web-v5.19.2
xo-web-v5.19.3
xo-web-v5.19.4
xo-web-v5.19.5
xo-web-v5.19.6
xo-web-v5.19.8
xo-web-v5.20.0
xo-web-v5.20.1
xo-web-v5.20.2
xo-web-v5.21.0
xo-web-v5.22.0
xo-web-v5.22.1
xo-web-v5.23.0
xo-web-v5.24.0
xo-web-v5.25.0
xo-web-v5.25.1
xo-web-v5.26.0
xo-web-v5.27.0
xo-web-v5.27.1
xo-web-v5.28.0
xo-web-v5.29.0
xo-web-v5.29.1
xo-web-v5.29.2
xo-web-v5.29.3
xo-web-v5.31.0
xo-web-v5.32.0
xo-web-v5.32.1
xo-web-v5.33.0
xo-web-v5.34.0
xo-web-v5.35.0
xo-web-v5.37.0
xo-web-v5.38.0
xo-web-v5.39.0
xo-web-v5.39.1
xo-web-v5.40.0
xo-web-v5.40.1
xo-web-v5.41.0
xo-web-v5.42.0
xo-web-v5.42.1
xo-web-v5.43.0
xo-web-v5.44.0
xo-web-v5.45.1
xo-web-v5.46.0
xo-web-v5.47.0
xo-web-v5.48.0
xo-web-v5.48.1
xo-web-v5.49.0
xo-web-v5.50.0
xo-web-v5.50.2
xo-web-v5.50.3