Permission Enforcement Flaw in Kill Bill by ThoughtWorks
CVE-2026-85213

7.2HIGH

Key Information:

Vendor

Killbill

Status
Killbill
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85213?

Kill Bill versions up to 0.24.21 are susceptible to a security issue where permission annotations are not enforced on critical AdminResource endpoints. This oversight enables authenticated users with basic permissions to access sensitive internal queues, clear server caches, and disrupt server operations by removing hosts from rotation. The lack of proper authorization controls poses a significant risk, potentially allowing unauthorized actions within the platform's administrative functionalities.

Affected Version(s)

killbill 0 <= 0.24.21

References

https://github.com/killbill/killbill/issues/2251
issue-tracking
https://github.com/killbill/killbill
product
https://github.com/killbill/killbill/blob/killbill-0.24.2...
technical-description

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.