CVE-2026-85213 — Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authentic…
Published: 2026-09-03 · CVSS: 7.2 · CVSS 4.0
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7