8.1
Élevée
CVE-2025-0628 An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm
Description
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| berriai/litellm 1.61 | premières → < 1.61.15-nightly | 1.61.15-nightly |
Références
- huntr.com huntr.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de berriai/litellm
Les 15 CVE de berriai/litellm →
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
8.8
Élevée
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service…
7.5
Élevée
CVE-2025-0330
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
7.5
Élevée
CVE-2024-9606
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a…
7.5
Élevée