Executive brief
Citrix Cloud, a platform used to manage and deploy Citrix technologies, contains a security flaw that allows users with restricted 'read-only' access to initiate administrative actions. Specifically, an attacker can trigger password reset or email change workflows and redirect security codes (OTPs) to their own email address. This could lead to unauthorized account access, data exposure, or a complete takeover of user accounts within the organization.
Technical details
An improper access control vulnerability (CWE-284) in Citrix Cloud allows an authenticated user with read-only permissions to initiate privileged workflows. By intercepting and manipulating server responses (e.g., modifying 'showMfaSettings' or 'canChangePassword' fields), an attacker can bypass client-side UI restrictions and access identity management features. The backend fails to sufficiently validate permissions before executing the initial stages of these workflows, resulting in the system sending One-Time Passwords (OTPs) to attacker-specified email addresses. While the exploit was demonstrated using SSO accounts, it poses a significant risk of full account takeover, especially for non-SSO accounts where password and email change flows are more direct.
Affected products
- Citrix Citrix Cloud through 2025-11-10
Timeline
- 2025-11-10: disclosed: Date of finding reported by researcher
- 2026-06-17: advisory: CVE published and NVD record created