Vulnerability · Published Jun 27, 2024 · Assigned by @huntr_ai
CVE-2024-5710Improper Access Control in Team Management in berriai/litellm
Medium 5.3
In plain English
A medium-severity missing authorization in berriai/litellm from berriai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | litellm | 1.40.15 | GHSA-qqcv-vg9f-5rr3 |
| PyPI | litellm | 1.40.15 | PYSEC-2026-1551 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| berriai | berriai/litellm | unspecified – through latest |
Weakness: CWE-862 · Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N