A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.
The CVSS severity warrants an early asset and exposure review.
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.
Confirm exposure before applying a vendor-supported change.
Confirm that pretix Venueless and an affected version are present.
Combine exploitation signals with asset exposure and business criticality.
Follow the vendor advisory or supported update path and preserve rollback options.
Recheck the version, service health, access paths, and relevant logs.
