An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Berriai |
|
No data.
No data.
References
History
Wed, 15 Oct 2025 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-285 |
Wed, 15 Oct 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-266 |
Thu, 20 Mar 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN. | |
| Title | Improper Authorization in BerriAI/litellm | |
| Weaknesses | CWE-285 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-03-20T10:10:45.400Z
Updated: 2025-10-15T12:50:05.101Z
Reserved: 2025-01-21T19:10:36.300Z
Link: CVE-2025-0628
Vulnrichment
Updated: 2025-03-20T17:49:24.269Z
NVD
Status : Awaiting Analysis
Published: 2025-03-20T10:15:53.407
Modified: 2025-10-15T13:16:00.713
Link: CVE-2025-0628
Redhat
No data.