CVE-2026-110111

Xen Orchestra versions prior to 6.9.0 are vulnerable to an improper access control flaw involving prototype pollution . An authenticated user can escalate privileges to global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. By directing the xo-ser...