An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can cancel tasks of other administrators.
https://support.citrix.com/article/CTX220112
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-14674