CVE-2026-5599: Pretix Venueless

High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

Affected products

• Pretix Venueless: from 0.0.0, before 02b9cbe5 (fixed in 02b9cbe5)

Published 2026-04-05. Last modified 2026-07-20.