{"id":"CVE-2026-85213","summary":"Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints","details":"Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.","modified":"2026-09-05T03:48:29.661685608Z","published":"2026-09-03T14:12:23.818Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85213.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85213.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85213"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/kill-bill-through-0.24.21-missing-authorization-on-adminresource-endpoints"},{"type":"REPORT","url":"https://github.com/killbill/killbill/issues/2251"},{"type":"PACKAGE","url":"https://github.com/killbill/killbill"},{"type":"ARTICLE","url":"https://github.com/killbill/killbill/blob/killbill-0.24.21/jaxrs/src/main/java/org/killbill/billing/jaxrs/resources/AdminResource.java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/killbill/killbill","events":[{"introduced":"0"},{"fixed":"5da9650de60b2fa83dea556d7e95c70b79dabd39"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.24.21"},{"fixed":"0.24.21"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["killbill-0.24.20","killbill-0.24.19","killbill-0.24.18","killbill-0.24.17","killbill-0.24.16","killbill-0.24.14","killbill-0.24.13","killbill-0.24.12","killbill-0.24.11","killbill-0.24.10","killbill-0.24.9","killbill-0.24.8","killbill-0.24.7","killbill-0.24.6","killbill-0.24.5","killbill-0.24.4","killbill-0.24.3","killbill-0.24.2","killbill-0.24.1","killbill-0.22.32","killbill-0.24.0","killbill-0.22.31","killbill-0.22.30","killbill-0.22.29","killbill-0.22.28","killbill-0.22.27","killbill-0.22.26","killbill-0.22.25","killbill-0.22.24","killbill-0.22.23","killbill-0.22.22","killbill-0.22.21","killbill-0.22.20","killbill-0.22.19","killbill-0.22.18","killbill-0.22.17","killbill-0.22.16","killbill-0.22.15","killbill-0.22.14","killbill-0.22.13","killbill-0.22.12","killbill-0.22.11","killbill-0.22.10","killbill-0.22.9","killbill-0.22.8","killbill-0.22.7","killbill-0.22.6","killbill-0.22.5","killbill-0.22.4","killbill-0.22.3","killbill-0.22.2","killbill-0.22.1","killbill-0.22.0","killbill-0.20.14","killbill-0.20.13","killbill-0.20.12","killbill-0.20.11","killbill-0.20.10","killbill-0.20.9","killbill-0.20.8","killbill-0.20.7","killbill-0.20.5","killbill-0.20.3","killbill-0.20.2","killbill-0.18.21","killbill-0.20.1","killbill-0.20.0","killbill-0.18.20","killbill-0.18.19","killbill-0.18.18","killbill-0.18.17","killbill-0.18.16","killbill-0.18.15","killbill-0.18.14","killbill-0.18.13","killbill-0.18.12","killbill-0.18.11","killbill-0.18.10","killbill-0.18.9","killbill-0.18.7","killbill-0.18.6","killbill-0.18.4","killbill-0.18.2","killbill-0.18.0","killbill-0.17.2","killbill-0.17.8","killbill-0.17.7","killbill-0.17.5","killbill-0.17.4","killbill-0.17.3","killbill-0.17.1","killbill-0.15.7","killbill-0.15.6","killbill-0.15.5","killbill-0.15.4","killbill-0.14.0","killbill-0.15.0","killbill-0.13.7","killbill-0.13.5","killbill-0.13.3","killbill-0.13.2","killbill-0.13.1","killbill-0.12.0","killbill-0.11.11","killbill-0.9.2","killbill-0.8.10","killbill-0.8.9","killbill-0.8.6","killbill-0.8.4","killbill-0.8.2","killbill-0.6.17","killbill-0.6.16","killbill-0.6.15","killbill-0.6.14","killbill-0.6.13","killbill-0.6.12","killbill-0.6.11","killbill-0.6.10","killbill-0.6.9","killbill-0.6.8","killbill-0.6.7","killbill-0.6.6","killbill-0.6.4","killbill-0.6.3","killbill-0.6.2","killbill-0.6.1","killbill-0.6.0","killbill-0.3.5","killbill-0.3.4","killbill-0.3.3","killbill-0.3.1","killbill-0.2.5","killbill-0.2.3","killbill-0.2.2","killbill-0.2.1","killbill-0.2.0","killbill-0.1.80","killbill-0.1.79","killbill-0.1.78","killbill-0.1.76","killbill-0.1.74","killbill-0.1.72","killbill-0.1.71","killbill-0.1.70","killbill-0.1.69","killbill-0.1.68","killbill-0.1.67","killbill-0.1.65","killbill-0.1.61","killbill-0.1.59","killbill-0.1.58","killbill-0.1.56","killbill-0.1.55","killbill-0.1.54","killbill-0.1.53","killbill-0.1.51","killbill-0.1.50","killbill-0.1.49","killbill-0.1.48","killbill-0.1.47","killbill-0.1.44","killbill-0.1.43","killbill-0.1.34","killbill-0.1.33","killbill-0.1.32","killbill-0.1.31","killbill-0.1.30","killbill-0.1.29","killbill-0.1.27","killbill-0.1.26","killbill-0.1.25","killbill-0.1.24","killbill-0.1.23","killbill-0.1.22","killbill-0.1.21","killbill-0.1.20","killbill-0.1.17","killbill-0.1.13","killbill-0.1.7","killbill-0.1.0","killbill-0.0.12","killbill-0.0.11","killbill-0.0.9","killbill-0.0.6","killbill-0.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85213.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"}]}