{"id":"CVE-2026-85213","title":"Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation","summary":"Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read in…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","cwe":["CWE-862"],"published":"2026-09-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T15:53:23.707","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85213","references":[{"url":"https://github.com/killbill/killbill","label":"disclosure@vulncheck.com"},{"url":"https://github.com/killbill/killbill/blob/killbill-0.24.21/jaxrs/src/main/java/org/killbill/billing/jaxrs/resources/AdminResource.java","label":"disclosure@vulncheck.com"},{"url":"https://github.com/killbill/killbill/issues/2251","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kill-bill-through-0.24.21-missing-authorization-on-adminresource-endpoints","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00219,"epssPercentile":0.12698,"ingestedAt":"2026-09-10T16:57:28.702Z","vendor":"killbill","product":"killbill","affected":["killbill <= 0.24.21"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-03T14:22:54.098530Z"},"slug":"CVE-2026-85213","body":"## Overview\n\nKill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}