EUVD-2026-70491
GHSA-2643-mcgh-r47h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requiring valid credentials (PR:L); cache flush and queue read give low C/I; putOutOfRotation yields high availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.
AnalysisAI
Missing authorization enforcement on Kill Bill's AdminResource endpoints through version 0.24.21 allows any authenticated low-privilege user - holding only account:read permissions - to read internal queue entries, flush server-side caches, and put the host out of rotation, effectively disabling the billing platform. The vulnerability stems from unenforced permission annotations in the JAX-RS AdminResource class, meaning the access-control declarations exist in code but are never evaluated at runtime. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user session - any account with at minimum account:read permissions can trigger the vulnerable endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.2 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H reflects an accurate risk profile: the attack requires valid credentials (PR:L), limiting opportunistic mass exploitation, but once authenticated the path to availability impact is trivial (AC:L, no further conditions). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is independently confirmed at time of analysis - the references point to a GitHub issue (#2251) and source code inspection rather than a tagged release containing a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Confirm your Kill Bill version (vulnerable through 0.24.21) and audit all authenticated user accounts, prioritizing removal of unnecessary low-privilege access grants. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today