Product
Xen Orchestra versions prior to 6.9.0 are vulnerable to privilege escalation via prototype pollution in ESXi import methods, allowing authenticated users to gain global administrator rights.