Description
A user with API access and "manage users" permission in any venueless
world is able to trigger deletion of user accounts in other worlds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pretix | Venueless | 0.0.0 – < 02b9cbe5 | 02b9cbe5 |
High · 7.3
CVE-2026-5599
EUVD-2026-19085
API allows deletion of users of other instance
Published Apr 5, 2026 · Updated Apr 6, 2026 · Assigned by rami.io