CVE-2026-113610 | Vates Xen Orchestra up to 6.8.99 xo-server user.set user id authorization

October 20, 2026 Yanac

A vulnerability marked as critical has been reported in Vates Xen Orchestra up to 6.8.99. This affects the function user.set of the component xo-server. This manipulation of the argument user id causes authorization bypass.

This vulnerability is handled as CVE-2026-113610. The attack can be initiated remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More