Killbill
Monthly
Missing authorization enforcement on Kill Bill's AdminResource endpoints through version 0.24.21 allows any authenticated low-privilege user - holding only account:read permissions - to read internal queue entries, flush server-side caches, and put the host out of rotation, effectively disabling the billing platform. The vulnerability stems from unenforced permission annotations in the JAX-RS AdminResource class, meaning the access-control declarations exist in code but are never evaluated at runtime. No public exploit code exists and CISA has not listed this in KEV; however, the availability impact (VA:H in the CVSS 4.0 vector) makes this a credible insider-threat or compromised-credential denial-of-service vector in any multi-tenant or employee-accessible Kill Bill deployment.
Missing authorization enforcement on Kill Bill's AdminResource endpoints through version 0.24.21 allows any authenticated low-privilege user - holding only account:read permissions - to read internal queue entries, flush server-side caches, and put the host out of rotation, effectively disabling the billing platform. The vulnerability stems from unenforced permission annotations in the JAX-RS AdminResource class, meaning the access-control declarations exist in code but are never evaluated at runtime. No public exploit code exists and CISA has not listed this in KEV; however, the availability impact (VA:H in the CVSS 4.0 vector) makes this a credible insider-threat or compromised-credential denial-of-service vector in any multi-tenant or employee-accessible Kill Bill deployment.