High severity · published Apr 5, 2026
CVE-2026-5599
API allows deletion of users of other instance
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
A user with API access and "manage users" permission in any venueless
world is able to trigger deletion of user accounts in other worlds.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Venueless · pretix
0.0.0 before 02b9cbe5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5599
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5599
github.com
https://github.com/venueless/venueless/security/advisories/GHSA-gwjc-33fv-2gh4
More from Venueless
7.3
CVE-2026-4982
Unauthorized access to chat contents
6.4
CVE-2026-82838
Default webserver configuration with incorrect CSP
5.1
CVE-2026-12863
Open redirect
5.1
CVE-2026-12862
XLSX formula injection in exports
2.3
CVE-2026-13350
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create