CVE-2026-5599

OVERVIEW CVE-2026-5599 affects venueless, a collaborative platform software. The vulnerability allows a user with standard API access and "manage users" permissions in any venueless world to delete user accounts across other worlds where they have no authorization. This permission bypass represents a cross-world privilege escalation issue. SEVERITY The attack requires valid API credentials with "manage users" permission, indicating low attack complexity and an authenticated attack vector. The impact is significant, as malicious insiders could permanently remove users from unrelated environments, causing denial of service and potential data loss. While no CVSS vector is currently published, the FAUCET Risk Score of 47.0/100 suggests moderate concern. EXPLOITATION STATUS This vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and has no reported active exploitation. The extremely low EPSS score of 0.0005 indicates minimal real-world exploitation likelihood. Community attention appears limited, with the vulnerability in an inactive status. No public exploit code has been identified, though the straightforward permission logic suggests exploitation would be relatively straightforward for an authenticated user.