Improper Authorization in BerriAI/litellm Application
CVE-2025-0628

8.1HIGH

Key Information:

Vendor

Berriai

Status
Berriai/litellm
Vendor
CVE Published:
20 March 2025

What is CVE-2025-0628?

An improper authorization vulnerability in the main-latest version of BerriAI/litellm allows users with the 'internal_user_viewer' role to obtain a privileged API key. This key grants access to critical administrative functions, including sensitive endpoints like '/users/list' and '/users/get_users'. As a result, this flaw poses a significant risk by enabling any user with this role to escalate their privileges and manage the application as a PROXY ADMIN.

Affected Version(s)

berriai/litellm < unspecified

References

https://huntr.com/bounties/6c0e2f75-2d03-42f9-9530-e16a97...
https://github.com/berriai/litellm/commit/566d9354aab4215...

CVSS V3.0

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-0628 : Improper Authorization in BerriAI/litellm Application