CVE-2026-5599 pretix CVE debrief

Who should care

Users with API access and 'manage users' permission in venueless worlds should verify their permissions and monitor for unauthorized account deletions. Additionally, administrators and security teams responsible for managing user accounts and API access in venueless worlds should be aware of this vulnerability and take necessary precautions.

Technical summary

A user with API access and 'manage users' permission in any venueless world can trigger deletion of user accounts in other worlds. This issue has a CVSS score of 7.3 and is classified as HIGH severity. The vulnerability is related to improper handling of user account management in venueless worlds, allowing an attacker to delete user accounts in other worlds. Further analysis is required to determine the full scope of the issue.

Defensive priority

High priority for venueless world administrators to restrict 'manage users' permissions and monitor API activity.

Recommended defensive actions

• Restrict 'manage users' permissions to only necessary personnel
• Monitor API activity for suspicious account deletion requests
• Implement additional logging and auditing for user account management
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from the NVD and CVE records indicate a potential vulnerability in venueless world user account management. Further analysis is required to determine the full scope of the issue. The CVE record was published on 2026-04-05T13:17:15.123Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. Defenders should verify their permissions and monitor for unauthorized account deletions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.