Skip to content
Heist/ feed
Back to feed
High

Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints

Type: advisorySources: OSV

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-85213
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 20:13 UTC · Revision 1

Source evidence

Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints

core-osv · Original source

Published 3 Sept 2026, 14:12 UTC

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

osv:CVE-2026-85213
Complete source record
{
  "id": "8ad682884aad38ebaf9ba6e6f9187181ffa9e0a8f7c545f77a3e702f9faf208a",
  "url": "https://osv.dev/vulnerability/CVE-2026-85213",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints",
    "summary": "Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.",
    "evidence": "osv:CVE-2026-85213",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-85213",
      "aliases": [
        "CVE-2026-85213"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/killbill/killbill",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "5da9650de60b2fa83dea556d7e95c70b79dabd39"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.24.21"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.24.21"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "killbill-0.24.21",
            "killbill-0.24.20",
            "killbill-0.24.19",
            "killbill-0.24.18",
            "killbill-0.24.17",
            "killbill-0.24.16",
            "killbill-0.24.14",
            "killbill-0.24.13",
            "killbill-0.24.12",
            "killbill-0.24.11",
            "killbill-0.24.10",
            "killbill-0.24.9",
            "killbill-0.24.8",
            "killbill-0.24.7",
            "killbill-0.24.6",
            "killbill-0.24.5",
            "killbill-0.24.4",
            "killbill-0.24.3",
            "killbill-0.24.2",
            "killbill-0.24.1",
            "killbill-0.22.32",
            "killbill-0.24.0",
            "killbill-0.22.31",
            "killbill-0.22.30",
            "killbill-0.22.29",
            "killbill-0.22.28",
            "killbill-0.22.27",
            "killbill-0.22.26",
            "killbill-0.22.25",
            "killbill-0.22.24",
            "killbill-0.22.23",
            "killbill-0.22.22",
            "killbill-0.22.21",
            "killbill-0.22.20",
            "killbill-0.22.19",
            "killbill-0.22.18",
            "killbill-0.22.17",
            "killbill-0.22.16",
            "killbill-0.22.15",
            "killbill-0.22.14",
            "killbill-0.22.13",
            "killbill-0.22.12",
            "killbill-0.22.11",
            "killbill-0.22.10",
            "killbill-0.22.9",
            "killbill-0.22.8",
            "killbill-0.22.7",
            "killbill-0.22.6",
            "killbill-0.22.5",
            "killbill-0.22.4",
            "killbill-0.22.3",
            "killbill-0.22.2",
            "killbill-0.22.1",
            "killbill-0.22.0",
            "killbill-0.20.14",
            "killbill-0.20.13",
            "killbill-0.20.12",
            "killbill-0.20.11",
            "killbill-0.20.10",
            "killbill-0.20.9",
            "killbill-0.20.8",
            "killbill-0.20.7",
            "killbill-0.20.5",
            "killbill-0.20.3",
            "killbill-0.20.2",
            "killbill-0.18.21",
            "killbill-0.20.1",
            "killbill-0.20.0",
            "killbill-0.18.20",
            "killbill-0.18.19",
            "killbill-0.18.18",
            "killbill-0.18.17",
            "killbill-0.18.16",
            "killbill-0.18.15",
            "killbill-0.18.14",
            "killbill-0.18.13",
            "killbill-0.18.12",
            "killbill-0.18.11",
            "killbill-0.18.10",
            "killbill-0.18.9",
            "killbill-0.18.7",
            "killbill-0.18.6",
            "killbill-0.18.4",
            "killbill-0.18.2",
            "killbill-0.18.0",
            "killbill-0.17.2",
            "killbill-0.17.8",
            "killbill-0.17.7",
            "killbill-0.17.5",
            "killbill-0.17.4",
            "killbill-0.17.3",
            "killbill-0.17.1",
            "killbill-0.15.7",
            "killbill-0.15.6",
            "killbill-0.15.5",
            "killbill-0.15.4",
            "killbill-0.14.0",
            "killbill-0.15.0",
            "killbill-0.13.7",
            "killbill-0.13.5",
            "killbill-0.13.3",
            "killbill-0.13.2",
            "killbill-0.13.1",
            "killbill-0.12.0",
            "killbill-0.11.11",
            "killbill-0.9.2",
            "killbill-0.8.10",
            "killbill-0.8.9",
            "killbill-0.8.6",
            "killbill-0.8.4",
            "killbill-0.8.2",
            "killbill-0.6.17",
            "killbill-0.6.16",
            "killbill-0.6.15",
            "killbill-0.6.14",
            "killbill-0.6.13",
            "killbill-0.6.12",
            "killbill-0.6.11",
            "killbill-0.6.10",
            "killbill-0.6.9",
            "killbill-0.6.8",
            "killbill-0.6.7",
            "killbill-0.6.6",
            "killbill-0.6.4",
            "killbill-0.6.3",
            "killbill-0.6.2",
            "killbill-0.6.1",
            "killbill-0.6.0",
            "killbill-0.3.5",
            "killbill-0.3.4",
            "killbill-0.3.3",
            "killbill-0.3.1",
            "killbill-0.2.5",
            "killbill-0.2.3",
            "killbill-0.2.2",
            "killbill-0.2.1",
            "killbill-0.2.0",
            "killbill-0.1.80",
            "killbill-0.1.79",
            "killbill-0.1.78",
            "killbill-0.1.76",
            "killbill-0.1.74",
            "killbill-0.1.72",
            "killbill-0.1.71",
            "killbill-0.1.70",
            "killbill-0.1.69",
            "killbill-0.1.68",
            "killbill-0.1.67",
            "killbill-0.1.65",
            "killbill-0.1.61",
            "killbill-0.1.59",
            "killbill-0.1.58",
            "killbill-0.1.56",
            "killbill-0.1.55",
            "killbill-0.1.54",
            "killbill-0.1.53",
            "killbill-0.1.51",
            "killbill-0.1.50",
            "killbill-0.1.49",
            "killbill-0.1.48",
            "killbill-0.1.47",
            "killbill-0.1.44",
            "killbill-0.1.43",
            "killbill-0.1.34",
            "killbill-0.1.33",
            "killbill-0.1.32",
            "killbill-0.1.31",
            "killbill-0.1.30",
            "killbill-0.1.29",
            "killbill-0.1.27",
            "killbill-0.1.26",
            "killbill-0.1.25",
            "killbill-0.1.24",
            "killbill-0.1.23",
            "killbill-0.1.22",
            "killbill-0.1.21",
            "killbill-0.1.20",
            "killbill-0.1.17",
            "killbill-0.1.13",
            "killbill-0.1.7",
            "killbill-0.1.0",
            "killbill-0.0.12",
            "killbill-0.0.11",
            "killbill-0.0.9",
            "killbill-0.0.6",
            "killbill-0.0.5"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85213.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.060469221Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85213.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-85213",
        "https://www.vulncheck.com/advisories/kill-bill-through-0.24.21-missing-authorization-on-adminresource-endpoints",
        "https://github.com/killbill/killbill/issues/2251",
        "https://github.com/killbill/killbill",
        "https://github.com/killbill/killbill/blob/killbill-0.24.21/jaxrs/src/main/java/org/killbill/billing/jaxrs/resources/AdminResource.java"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85213.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-85213",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 489662,
  "published_at": "2026-09-03T14:12:23.818+00:00"
}