CVE-2026-5599 HIGH

CVE-2026-5599: API allows deletion of users of other instance

Vendor Pretix

Product Venueless

Weakness CWE-653

Published April 5, 2026

Last update April 6, 2026

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:H

What the vulnerability does

01Description

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

Key dates

April 5, 2026 CVE published

April 6, 2026 Record updated

External resources

Related vulnerabilities