Is CVE-2026-113610 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-113610?

CVE-2026-113610 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-113610

Description

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.