CVE-2026-12799: BerriAI LiteLLM improper authorization in ui_view_users function

CVE-2026-12799 · Severity: medium · CVSS 4.3 · Published 2026-06-21

BerriAI litellm is an open-source proxy platform that manages API access and user permissions. A flaw in the user management endpoint allows any authenticated user with minimal privileges to retrieve a complete list of all system users—including administrative accounts and users from other organizations—along with their email addresses and internal identifiers. While this does not allow direct data modification or service disruption, it enables attackers to enumerate sensitive user information for targeted attacks such as phishing, and can serve as reconnaissance for exploiting related vulnerabilities in multi-tenant deployments.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12799 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12799 being exploited in the wild.
How severe is CVE-2026-12799?
Medium severity, with a CVSS score of 4.3, published 21 June 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.82.2, up to 1.82.2; litellm (PyPI) ECOSYSTEM:introduced=0,last_affected=1.82.2.
Is there a fix for CVE-2026-12799?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12799 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12799?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from an architectural misconfiguration of routing whitelists combined with missing authorization enforcement. The /user/filter/ui endpoint is explicitly registered in the info_routes whitelist in litellm/proxy/_types.py, which causes the global routing authorization middleware (non_proxy_admin_allowed_routes_check in litellm/proxy/auth/route_checks.py) to skip standard RBAC validation. The handler function ui_view_users in internal_user_endpoints.py lacks internal authorization checks (such as _user_has_admin_view validation) that should verify the caller's privilege level, thus trusting the flawed middleware. Any authenticated user with a valid API key—even one with internal_user_viewer role—can issue a GET request to /user/filter/ui and retrieve the filtered user table containing all administrative and cross-tenant email addresses and user_id UUIDs. The attack requires network access to the LiteLLM instance and valid authentication credentials, but no additional user interaction. No patch has been released as of the advisory publication date.

Affected products

  • BerriAI litellm <= 1.82.2

Identifiers

  • CVE-2026-12799
  • GHSA-m2v5-74w2-qhcj
  • PYSEC-2026-4072

Timeline

  • 2026-06-21: disclosed
  • 2026-09-14: advisory: GitHub Advisory reviewed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.