CVE-2026-5599
NoneCVSS
—
EPSS
0.4%
Published
Apr 5, 2026
CISA due date
—
The record
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
- CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
- GHSA-gqmf-56h7-rrpf npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware… CWE-653
- CVE-2026-41155 An attacker could cooperatively pass data from one secure GPU process to another secure… CWE-653
- CVE-2026-42782 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
- CVE-2026-44009 vm2 is an open source vm/sandbox for Node.js. CWE-653
- CVE-2026-44005 vm2 is an open source vm/sandbox for Node.js. CWE-653
- CVE-2026-43997 vm2 is an open source vm/sandbox for Node.js. CWE-653