PT-2026-30436 · Venueless · Venueless

Pratik Karan · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5599

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions venueless versions (affected versions not specified)

Description A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds. The issue involves the ability to delete user accounts across different instances via the API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-5599

Affected Products

Venueless

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5599 · Security Note
• https://github.com/venueless/venueless/security/advisories/GHSA-gwjc-33fv-2gh4 · Note
• https://twitter.com/infoflowcloud/status/2040780434234081619 · Twitter Post
• https://twitter.com/cyberbivash/status/2040794795858157702 · Twitter Post
• https://twitter.com/cyberbivash/status/2040802655618891871 · Twitter Post
• https://twitter.com/CVEnew/status/2040780260694769917 · Twitter Post
• https://twitter.com/cyberbivash/status/2040788570990875006 · Twitter Post