Executive brief
BerriAI litellm is an open-source proxy platform that manages API access and user permissions. A flaw in the user management endpoint allows any authenticated user with minimal privileges to retrieve a complete list of all system users—including administrative accounts and users from other organizations—along with their email addresses and internal identifiers. While this does not allow direct data modification or service disruption, it enables attackers to enumerate sensitive user information for targeted attacks such as phishing, and can serve as reconnaissance for exploiting related vulnerabilities in multi-tenant deployments.
Technical details
This vulnerability stems from an architectural misconfiguration of routing whitelists combined with missing authorization enforcement. The /user/filter/ui endpoint is explicitly registered in the info_routes whitelist in litellm/proxy/_types.py, which causes the global routing authorization middleware (non_proxy_admin_allowed_routes_check in litellm/proxy/auth/route_checks.py) to skip standard RBAC validation. The handler function ui_view_users in internal_user_endpoints.py lacks internal authorization checks (such as _user_has_admin_view validation) that should verify the caller's privilege level, thus trusting the flawed middleware. Any authenticated user with a valid API key—even one with internal_user_viewer role—can issue a GET request to /user/filter/ui and retrieve the filtered user table containing all administrative and cross-tenant email addresses and user_id UUIDs. The attack requires network access to the LiteLLM instance and valid authentication credentials, but no additional user interaction. No patch has been released as of the advisory publication date.
Affected products
- BerriAI litellm <= 1.82.2
Timeline
- 2026-06-21: disclosed
- 2026-09-14: advisory: GitHub Advisory reviewed and published