GitHub Advisoryadvisory · PyPI

GHSA-m2v5-74w2-qhcj BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

LOW Published 2026-06-21 Modified 2026-09-14 Official page ↗
Aliases
CVE-2026-12799
Ecosystem
PyPI
Packages
litellm
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-266
Reviewed
2026-09-14

Affected packages

• PyPI litellm: <= 1.82.2 (no fix yet)

Description

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Related

Alias · CVE (1)

  • CVE-2026-12799 A security vulnerability has been detected in BerriAI litellm up to 1.82.2. vulnerability

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References