VULNERABILITY INTELLIGENCE
CVE-2026-85213
CVSS score7.2 HIGH
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-09-03
Last modified2026-09-10
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Description
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.
Weakness classification
- CWE-862: Missing Authorization