CVE-2026-12799: BerriAI litellm Incomplete Authorization Fix Disclosure

Technical summary

CVE-2026-12799 stems from improper authorization controls in the ui_view_users function within litellm/proxy/management_endpoints/internal_user_endpoints.py. This vulnerability represents an incomplete remediation of CVE-2025-0628, indicating that the original authorization bypass was only partially addressed. The flaw allows an authenticated user to access or retrieve information about other users without proper privilege checks. The vulnerability is rooted in inadequate enforcement of authorization policies (CWE-266: Improper Privilege Management; CWE-285: Improper Authorization) and requires network access with valid credentials to exploit.

Business impact

For organizations running litellm proxies in shared or multi-tenant environments, this vulnerability enables user enumeration and information disclosure. An internal attacker or compromised service account can discover other users and their associated metadata, potentially informing lateral movement or social engineering attacks. The exposure is bounded to authenticated users, but in managed services or internal platforms serving multiple teams, this creates a meaningful privacy and operational security risk.

Affected systems

BerriAI litellm versions up to and including 1.82.2 are affected. Organizations using litellm as a proxy layer for LLM API management should audit their deployments. The vulnerability is specific to the user management endpoint and does not affect underlying LLM inference or non-administrative API routes.

Exploitability

The vulnerability requires an attacker to possess valid authentication credentials to the litellm proxy. No user interaction or special configuration is needed beyond authentication. The exploit has been publicly disclosed, and proof-of-concept details may be available, increasing the likelihood of opportunistic attacks against exposed or shared credentials. However, the need for prior authentication prevents widespread unauthenticated exploitation.

Remediation

Upgrade litellm to a version newer than 1.82.2 that fully addresses the authorization bypass. Verify against the vendor advisory that the patched version resolves both the original CVE-2025-0628 and this incomplete fix. In the interim, restrict access to the proxy management endpoints through network controls or API gateway policies, and audit user access logs for suspicious view_users calls.

Patch guidance

Apply the latest stable release of BerriAI litellm beyond version 1.82.2. Consult the official litellm GitHub releases or vendor advisory to confirm the specific patched version. Test the upgrade in a staging environment to ensure compatibility with your LLM proxy configuration before rolling to production. Monitor proxy logs immediately after patching to detect any exploitation attempts preceding the upgrade.

Detection guidance

Monitor litellm proxy logs for repeated or suspicious calls to the /internal/user_endpoints/users endpoint (or equivalent user enumeration routes). Look for authenticated sessions making requests to list or view user information from accounts that should not have administrative privileges. Baseline normal administrative activity and alert on anomalies. Check recent API audit trails for unauthorized user data access patterns, especially if credentials have been shared or recently compromised.

Why prioritize this

Although the CVSS score is medium (4.3) and authentication is required, the incomplete fix nature of this vulnerability indicates a systemic gap in authorization logic. Organizations must prioritize patching to prevent information leakage in multi-tenant or sensitive environments. The public disclosure and availability of proof-of-concept details increase urgency for patching before attackers test this against real deployments.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects the need for prior authentication and limited scope (confidentiality impact only, no integrity or availability impact). However, the contextual severity is elevated by the public disclosure, the sensitive nature of user enumeration in proxy environments, and the track record of incomplete fixes (this being a redo of CVE-2025-0628). Organizations with strict user isolation requirements should treat this as a priority patch despite the moderate base score.

Frequently asked questions