CVE-2026-85213 is a high severity missing authorization flaw in Kill Bill through 0.24.21. Several AdminResource endpoints skip permission checks, so a user with only account read access can read internal queues, clear caches and take a host out of rotation. No fixed release is confirmed.
What's affected
- Product: Kill Bill billing platform,
AdminResourcein the JAX-RS module. - Affected per VulnCheck: up to and including 0.24.21.
- Fixed version: not confirmed. Issue #2251 was open when read, and a maintainer had asked the reporter for specifics.
- Endpoints named in the issue: the queues listing, cache invalidation and the healthcheck rotation toggles under
/1.0/kb/admin/.
Severity in the record: High, CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). VulnCheck scores it 7.2 under CVSS v4, against 7.6 under CVSS v3.1 in the record.
Weakness class: CWE-862 (Missing Authorization).
How to check if you're exposed
- Check your Kill Bill version in the server banner or your deployment manifest.
- From a test account with minimal permissions, such as account read only, ask whether the admin endpoints answer with success. Do this only on a system you own.
- Review the reverse proxy configuration. Anything that lets users reach
/1.0/kb/admin/from outside an operations network is a candidate for restriction. - Look through access logs for calls to those admin paths by non-admin users.
What to do now
- Block the
/1.0/kb/admin/path at your proxy for everyone except operations staff and networks. - Watch the Kill Bill repository for a fix and upgrade when one ships.
- Review the list of users and roles, and remove accounts that are not needed.
- Make sure load balancer health checks do not trust the toggle state alone, so one call cannot silently take all nodes out of service.
- Add monitoring for sudden cache clears or nodes leaving rotation.
Why it matters
Kill Bill checks permissions with an annotation that the framework reads on the API method. The issue explains that these endpoints call internal utilities directly, so no annotated method sits in the path and the check never fires. The Shiro filter chain requires a valid login but nothing more. That is CWE-862, missing authorization.
The result is mostly about availability and information. Reading the internal event queues can expose business data, and flipping the health state can pull a node from service. Billing platforms sit at the center of revenue, so even moderate impact deserves a fast response. The record does not mark this CVE as exploited in the wild.
Try it yourself
This demo shows how an API scan flags admin routes that answer to low privilege callers.
Click through it at your own pace, or open it full screen.
Quick check
Do I need admin rights to use these endpoints?
No. The issue says any authenticated user can reach them, even one with only account read permission.
Sources
Last reviewed: 18 October 2026.
