A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 5, 2026 · NIST NVD

   Detected

   A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

2. Jul 20, 2026 · NIST NVD

   Updated

   A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

Sources

• CVE.orgVulnerability recordCVE-2026-5599

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-5599

  A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

  nvd.nist.gov

References

• Reference · github.com