CVE-2025-0628: BerriAI/LiteLLM Privilege Escalation Flaw

CVE-2025-0628 Overview

CVE-2025-0628 is an improper authorization vulnerability [CWE-266] in the main-latest version of BerriAI/litellm, an open-source LLM proxy framework. When a user assigned the internal_user_viewer role logs into the application, the backend issues an overly privileged API key. The key grants access to administrative endpoints such as /users/list and /users/get_users, which should be restricted to proxy administrators. Any authenticated low-privilege user can escalate to PROXY ADMIN and enumerate or modify user records across the deployment.

Critical Impact
Any authenticated user with the internal_user_viewer role can escalate privileges to PROXY ADMIN and access administrative user-management endpoints exposed by the litellm proxy.

Affected Products

BerriAI/litellm (main-latest branch prior to commit 566d9354aab4215091b2e51ad0333e948125fa1b)
Deployments exposing the litellm proxy UI and admin API endpoints
LLM gateway environments relying on litellm role-based access control

Discovery Timeline

2025-03-20 - CVE-2025-0628 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0628

Vulnerability Analysis

The vulnerability stems from improper authorization enforcement during the issuance of API keys for the internal_user_viewer role. The role is intended to provide read-only visibility within litellm. Instead, the proxy generates an API key whose effective permission set overlaps with the master key. The issued key is then accepted by routes guarded by user_api_key_auth, including endpoints that return full user records. An attacker with any internal_user_viewer account can therefore enumerate accounts, view sensitive metadata, and pivot to PROXY ADMIN operations within the litellm proxy.

Root Cause

The root cause is a missing distinction between viewer-tier permissions and admin-tier permissions in the proxy route configuration. The ui_view_users handler in litellm/proxy/management_endpoints/internal_user_endpoints.py returned the unfiltered LiteLLM_UserTable model to any authenticated caller. The route table in litellm/proxy/_types.py did not explicitly bind viewer-scoped endpoints to a constrained role list, allowing privilege boundaries to collapse.

Attack Vector

Exploitation requires network access to the litellm proxy and valid credentials for an internal_user_viewer account. The attacker authenticates, receives the over-privileged API key, and issues authenticated requests to /users/list, /users/get_users, or /user/filter/ui. The responses expose all user records, after which the attacker reuses the key to invoke admin-only actions and obtain PROXY ADMIN capabilities.

python

# Security patch: litellm/proxy/_types.py - adds /user/filter/ui to the
# explicitly allowed viewer route set so administrative routes are no longer
# implicitly accessible to lower-privileged roles.
        "/model_group/info",
        "/health",
        "/key/list",
+       "/user/filter/ui",
    ]

    # NOTE: ROUTES ONLY FOR MASTER KEY - only the Master Key should be able to Reset Spend

Source: BerriAI/litellm commit 566d9354

python

# Security patch: litellm/proxy/management_endpoints/internal_user_endpoints.py
# Replaces the unfiltered LiteLLM_UserTable response model with a filtered
# variant that strips sensitive fields from viewer responses.
    dependencies=[Depends(user_api_key_auth)],
    include_in_schema=False,
    responses={
-       200: {"model": List[LiteLLM_UserTable]},
+       200: {"model": List[LiteLLM_UserTableFiltered]},
    },
)
async def ui_view_users(

Source: BerriAI/litellm commit 566d9354

Detection Methods for CVE-2025-0628

Indicators of Compromise

Authenticated requests to /users/list, /users/get_users, or /user/filter/ui originating from API keys tied to non-admin accounts.
Unexpected role transitions in litellm audit logs where users gain PROXY ADMIN privileges without administrator action.
Bursts of user enumeration requests from a single API key shortly after an internal_user_viewer login event.

Detection Strategies

Correlate proxy access logs against the assigned role of each API key and alert when viewer-tier keys reach admin routes.
Hash and inventory issued API keys, then flag any key whose route usage diverges from its documented role scope.
Inspect HTTP responses for LiteLLM_UserTable payloads returned to non-admin sessions, which indicates the unpatched code path is still in use.

Monitoring Recommendations

Forward litellm proxy logs to a centralized analytics platform and build queries around administrative endpoint paths.
Track creation of new internal_user_viewer accounts and review their subsequent API activity within 24 hours.
Monitor for changes to user roles, key spend limits, or master-key-only configuration values initiated by non-admin principals.

How to Mitigate CVE-2025-0628

Immediate Actions Required

Upgrade litellm to a build that includes commit 566d9354aab4215091b2e51ad0333e948125fa1b or later.
Rotate all API keys issued to internal_user_viewer accounts and invalidate sessions created before the upgrade.
Audit the user table for unauthorized PROXY ADMIN assignments and revert any that cannot be tied to a legitimate change request.

Patch Information

BerriAI merged the fix in pull request #8740. The patch updates litellm/proxy/_types.py to explicitly scope /user/filter/ui and modifies ui_view_users in litellm/proxy/management_endpoints/internal_user_endpoints.py to return the filtered LiteLLM_UserTableFiltered model. Review the BerriAI/litellm commit 566d9354 and the Huntr bounty disclosure for full context.

Workarounds

Restrict the litellm proxy UI and admin endpoints to a trusted management network until patched builds are deployed.
Disable creation of internal_user_viewer accounts and require master-key authentication for user-management routes.
Place a reverse proxy in front of litellm that denies non-admin callers access to /users/* and /user/filter/ui.

bash

# Example NGINX rule to block viewer-tier access to admin routes
location ~ ^/(users/list|users/get_users|user/filter/ui) {
    if ($http_authorization !~* "Bearer sk-admin-") {
        return 403;
    }
    proxy_pass http://litellm_upstream;
}