CVE-2026-85213CWE-862broken-access-control

CVE-2026-85213

High · published September 3, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00394 · 32.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-03T19:17Z
References (4)
https://github.com/killbill/killbill · [email protected]https://github.com/killbill/killbill/blob/killbill-0.24.21/jaxrs/src/main/java/org/killbill/billing/jaxrs/resources/AdminResource.java · [email protected]https://github.com/killbill/killbill/issues/2251 · [email protected]https://www.vulncheck.com/advisories/kill-bill-through-0.24.21-missing-authorization-on-adminresource-endpoints · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 14:12Z
    Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
    cvelistv5