Venueless CVE-2026-5599

Attacker requires API access and 'manage users' permission in any venueless world. Can then trigger deletion of user accounts across other worlds without additional authentication. No victim interaction needed.

Real-world risk is significant for multi-tenant venueless deployments despite requiring authenticated access. The CVSS 7.3 score accurately reflects the network attack vector (AV:N) with low complexity (AC:L) requiring only low privileges (PR:L), enabling any authenticated user with 'manage users' permission in any single world to impact other worlds. The high system-level confidentiality, integrity, and availability impacts (SC:H/SI:H/SA:H) indicate this breaks fundamental tenant isolation, a critical security boundary in SaaS architectures. While no KEV listing or public exploit code exists, the low attack complexity and clear impact on data integrity make this immediately actionable for operators of multi-world venueless instances. EPSS data not provided, but the specificity of required permissions (API access plus manage users role) somewhat limits attack surface compared to unauthenticated vulnerabilities. SSVC assessment suggests scheduled patching priority: exploitation not confirmed, but automatable via API and causing high technical impact through unauthorized cross-tenant data deletion.

An attacker with legitimate API credentials and 'manage users' permission in World A (e.g., a moderator account for a public event) crafts API requests to delete user accounts in World B (a separate organization's private conference), bypassing tenant isolation controls. By enumerating or predicting user IDs across worlds, the attacker systematically deletes accounts in target worlds, causing service disruption and data loss for unrelated tenants. The low attack complexity (AC:L) means standard API tooling suffices, requiring no specialized exploits, making this readily automatable once an attacker gains the initial authenticated foothold.