Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

berrrai/litellm lets attackers manage teams without permission

CVE-2024-5710 · published 2 years ago
Summary

Version 1.34.34 of berriai/litellm does not correctly check who is allowed to use its team management features. As a result, an unauthenticated or low‑privilege user could create, edit, view, delete, block, unblock teams and add or remove any team members. Upgrade to a version that fixes the access checks or apply the vendor’s recommended configuration changes as soon as possible.

What to do
  • Update berriai litellm to version 1.40.15.
Affected software
Ecosystem VendorProductAffected versions
pip berriai litellm < 1.40.15
Fix: upgrade to 1.40.15
– litellm litellm 1.34.34
cpe:2.3:a:litellm:litellm:1.34.34:*:*:*:*:*:*:*
Original advisory text
Improper Access Control in Team Management in berriai/litellm
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
CWE-862Missing Authorization
Timeline
Published27 Jun 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-qqcv-vg9f-5rr3 · GHSA
CVE-2024-5710 · NVD
CVE-2024-5710 · OSV
PYSEC-2026-1551 · OSV
Track software like this
Free during beta