CVE-2026-5599
High
Description
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.
SeverityHigh
CVSS7.3
Exploit probability—
ProductVenueless
PublishedApr 5, 2026
First seenApr 5, 2026
Weakness typeCWE-653CWE-653
How to fix
Update
- pretix Venueless02b9cbe5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pretix Venueless | v < 02b9cbe5 | 02b9cbe5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.