Executive brief
Kill Bill is an open-source billing and payments platform. Several administrative API endpoints fail to properly enforce access controls, allowing authenticated users with minimal read permissions to access sensitive internal operations such as reading message queues, clearing server caches, and disabling the server. This could enable unauthorized service disruption and data access by low-privileged users.
Technical details
Kill Bill's AdminResource class fails to enforce permission annotations on several endpoints, including getQueueEntries, invalidatesCache, and putOutOfRotation. The vulnerability is an authorization bypass where endpoints that should require elevated privileges instead accept requests from authenticated users with only basic account:read permissions. An attacker with minimal credentials can read internal message queues, flush server caches, and place the server out of rotation, disrupting operations. Affected versions through 0.24.21 are vulnerable; patches should be available in later releases.
Affected products
- Kill Bill Kill Bill through 0.24.21
Timeline
- 2026-09-03: disclosed