CVE-2026-5599
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in the venueless system allows a user with API access and 'manage users' permission in any world to trigger deletion of user accounts in other worlds.
Risk Assessment
The risk involves unauthorized deletion of user accounts across different worlds, potentially leading to data loss and disruption of organizational operations.
Recommendation
Immediately restrict 'manage users' permissions to only necessary worlds and update the venueless system to the latest patched version.
Other vulnerabilities in venueless
See all- CVE-2026-4982High
A user with 'update world' permission in any Venueless world can exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. Exploitation requires knowledge of the internal channel UUID.
- CVE-2026-82838Medium
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
Original NVD description (English source)
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.