CVE-2026-5599

Description

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

References

• https://github.com/venueless/venueless/security/advisories/GHSA-gwjc-33fv-2gh4