CVE-2026-5599 involves an improper isolation vulnerability (CWE-653) in pretix Venueless that allows a user with API access and the "manage users" permission in one Venueless world to delete user accounts in other worlds. This cross-world permission flaw breaks the intended compartmentalization between separate Venueless worlds, enabling unauthorized user account deletion across boundaries. The vulnerability has a CVSS 4.0 score of 7.3, reflecting network attack vector, low attack complexity, and partial privileges required. No official remediation or patch information is currently provided by the vendor, and no exploits are known in the wild. The affected version is indicated as 0.0.0, suggesting early or unspecified versions are impacted.

An attacker with API access and the "manage users" permission in any Venueless world can delete user accounts in other worlds, potentially leading to unauthorized account removals across isolated environments. This compromises the integrity and isolation of user management between different Venueless worlds. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Restrict API access and the "manage users" permission to trusted users only as a precautionary measure until a fix is available.