VSA-2026-053: Broken Access Control in XO5 Due to Missing Server-side Object Filtering
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-29 | 2026-10-29 | 🟠Moderate | Not available yet | - Xen Orchestra / Xen Orchestra Appliance |
A vulnerability was discovered in Xen Orchestra that is part of the Xen Orchestra Appliance. We classify the impact as Moderate. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
In XO5, xo-server send all objects (Xen objects, users UUID, etc) to every authenticated user regardless of their permissions. Access restrictions (ACLs, resource sets) were applied in client-side on xo-web. Because authorization checks is not enforced in server-side, an adversary could obtain all objects by intercepting and modifying the websocket traffic, or through methods such as xo.getAllObjects() bypassing xo-web permissions checks.
Impact​
An unprivileged user ("permission": "none") can bypass the intended restrictions and access information reserved for higher-privileged roles like Admin.
- Xen Orchestra before 6.10.0 : Affected
- Xen Orchestra Appliance: Affected
Status​
- Released
Mitigations​
Security fixes are delivered to the latest channel before the stable channel. Switching to latest therefore allows earlier remediation, although this channel may be less stable.
There are no known mitigations.
Resolution​
As of 2026-10-29, Xen Orchestra version 6.10.0 has been released and includes the fix for this issue. It is currently available on the latest channel and should become available on stable in the next version in about a month.
List of packages fixing this issue:
- xo-server: 5.212.0
- xo-acl-resolver: 0.6.0
- xo-web: 5.207.0