Technical impact
A user who has API access and the "manage users" permission in any Venueless world can delete user accounts that belong to other worlds. This cross‑instance authorization bypass removes legitimate user data and can disrupt service availability for unaffected users. The weakness is a zero‑click, cross‑instance privilege escalation, identified as CWE‑653.
Affected Systems
All releases of the Venueless product from pretix are potentially affected, as no specific version ranges are provided. Existing installations should assume this vulnerability is present until a patch is released.
Risk and Exploitability
The CVSS score of 7.3 indicates moderate to high severity. Exploit probability data is not published, and the vulnerability is not currently listed in the known exploited vulnerabilities catalog. Because the attack requires only API access with the "manage users" permission, the risk of exploitation is significant. The likely attack vector is remote via the public API, and an attacker can directly delete accounts belonging to other instances.
