A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.CreditsPratik KaranReferenceshttps://github.com/venueless/venueless/security/advisories/GHSA-gwjc-33fv-2gh4
