xen-orchestra vulnerabilities
CVEs whose affected-version data names the xen-orchestra package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113610Medium· 5.4Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. At…
▾ Sunlitvatesfr · xen-orchestravia CVEORG
CVE-2026-110111High· 7.5Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers …
▾ Twilightvatesfr · xen-orchestraEPSS 0.62%via NVD