PT-2025-12318 · Unknown · Berriai/Litellm

Published 2025-03-20 · Updated 2025-03-23 · CVE-2025-0628

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions BerriAI/litellm version main-latest

Description The issue is related to improper authorization. When a user with the role internal user viewer logs into the application, they are provided with an overly privileged API key. This key allows access to all admin functionality, including endpoints such as "/users/list" and "/users/get users". The vulnerability enables privilege escalation within the application, allowing any account to become a proxy admin.

Recommendations For BerriAI/litellm version main-latest, consider restricting access to the /users/list and /users/get users endpoints until a fix is available. As a temporary workaround, review and limit the privileges assigned to the internal user viewer role to prevent unauthorized access to admin functionality.

Fix

LPE

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-0628

GHSA-FJCF-3J3R-78RP

Affected Products

Berriai/Litellm

References · 10

• https://osv.dev/vulnerability/CVE-2025-0628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0628 · Security Note
• https://osv.dev/vulnerability/GHSA-fjcf-3j3r-78rp · Vendor Advisory
• https://github.com/BerriAI/litellm · Note
• https://github.com/berriai/litellm/commit/566d9354aab4215091b2e51ad0333e948125fa1b · Note
• https://t.me/cvetracker/19524 · Telegram Post
• https://t.me/cvedetector/20710 · Telegram Post
• https://huntr.com/bounties/6c0e2f75-2d03-42f9-9530-e16a973317fc · Note
• https://twitter.com/RedTeamNewsBlog/status/1903733455588135066 · Twitter Post
• https://twitter.com/CVEnew/status/1902671074078118074 · Twitter Post