CVE-2026-85213

Name of the Vulnerable Software and Affected Versions Kill Bill versions prior to 0.24.22

Description Insufficient enforcement of permission annotations on several 'AdminResource' endpoints allows authenticated users with minimal account:read permissions to perform unauthorized actions. This includes the ability to read internal queues via the 'getQueueEntries' endpoint, flush server caches through the 'invalidatesCache' endpoint, and disable the server by using the 'putOutOfRotation' endpoint.

Recommendations Update to version 0.24.22 or later. As a temporary mitigation, restrict access to the 'AdminResource' endpoints for users with only account:read permissions.