CVE-2026-85213: Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit the affected endpoints?
Any authenticated user granted minimal account:read permissions can access the affected AdminResource endpoints. No additional privileges or user interaction are required.
What could an attacker do through these endpoints?
They can read internal queue entries, invalidate server caches, and place the host out of rotation, which can disable the server.
Which deployments are affected?
Kill Bill through version 0.24.21 is affected where users can authenticate with account:read permission. The provided information does not state whether a particular default role or configuration grants that permission.
How can I determine whether my instance is exposed?
Check whether the deployment runs Kill Bill 0.24.21 or earlier and whether minimally privileged authenticated users have account:read permission. Review access to the AdminResource getQueueEntries, invalidatesCache, and putOutOfRotation endpoints.