The vulnerability resides in Xen Orchestra’s xo‑server user.set API, permitting an authenticated user with limited privileges to modify the preference settings of any other user by supplying an arbitrary target user ID. The attacker can change sensitive values such as the TOTP secret, the stored xsCredentials, or SSH keys, potentially disabling two‑factor authentication, blocking future logins, or hijacking credentials for elevation of privilege. This reflects a classic authorization bypass weakness identified as CWE‑639.

Any Xen Orchestra Server running a version prior to 6.9.0 is affected. The product is produced by vatesfr under the brand Xen Orchestra. No later versions beyond 6.9.0 are impacted by this specific flaw.

The CVSS score of 5.3 indicates moderate severity. EPSS information is not provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session; the attacker must be able to call the user.set API. Once authenticated, even at a low privilege level, the attacker can alter sensitive user preferences, leading to loss of 2FA protection and potential credential compromise.