Kill Bill versions through 0.24.21 do not enforce permission annotations on several administrative REST endpoints. An authenticated user with only minimal “account:read” permissions can invoke “getQueueEntries” to read internal queue state, “invalidatesCache” to flush server caches, or “putOutOfRotation” to disable the server by marking the host out of rotation. This missing authorization flaw allows a low‑privilege account to perform privileged operations that can compromise system availability and disrupt billing operations.

Kill Bill open‑source billing platform, versions up to and including 0.24.21. The vulnerable administrative endpoints are defined in the AdminResource class and include getQueueEntries, invalidatesCache, and putOutOfRotation.

The CVSS score of 7.2 reflects a moderate to high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated account; because authorization checks are missing, an attacker who can log in with minimal read rights can execute the privileged operations. The lack of enforcement permits unauthorized users to access internal data, destabilize the system, or cause a denial of service. Given the severity and the required privileges, administrators should treat this as a high‑risk exposure that can lead to operational disruption.