vatesfr CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM vatesfr CVE published 2026-10-20

CVE-2026-113610

CVE-2026-113610 is an authorization bypass vulnerability in Xen Orchestra before 6.9.0, allowing low-privileged authenticated users to modify other users' preferences via the user.set API method. This could lead to the deletion of two-factor authentication secrets, corruption of login credentials, or overwriting of stored xsCredentials and sshKeys.