CVE-2026-12799 Overview
CVE-2026-12799 is an improper authorization vulnerability in BerriAI litellm through version 1.82.2. The flaw exists in the ui_view_users function within litellm/proxy/management_endpoints/internal_user_endpoints.py. The issue represents an incomplete fix for CVE-2025-0628, allowing low-privileged authenticated users to access user management data they should not see. The vulnerability is remotely exploitable over the network and a proof-of-concept has been disclosed publicly. The weakness is tracked under CWE-266: Incorrect Privilege Assignment.
Critical Impact
Authenticated users with low privileges can invoke the ui_view_users endpoint to enumerate user records on the litellm proxy, exposing account information that should be restricted to administrators.
Affected Products
- BerriAI litellm versions up to and including 1.82.2
- litellm proxy management endpoints (internal_user_endpoints.py)
- Deployments relying on the prior CVE-2025-0628 patch as a security boundary
Discovery Timeline
- 2026-06-21 - CVE-2026-12799 published to the National Vulnerability Database
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-12799
Vulnerability Analysis
The vulnerability resides in the ui_view_users handler exposed by the litellm proxy management API. This endpoint returns user account information consumed by the litellm administrative UI. The earlier patch released for CVE-2025-0628 attempted to enforce role-based access checks on this endpoint but did not cover every code path. As a result, callers holding a valid but non-administrative API key can still reach the function and retrieve user records. Because litellm proxies are commonly internet-facing to serve LLM API traffic, the exposure widens the blast radius beyond internal networks.
Root Cause
The root cause is incomplete privilege enforcement in the ui_view_users function. The function performs authentication but does not consistently verify that the calling principal holds the administrator role required to read user listings. This maps to CWE-266 (Incorrect Privilege Assignment), and the disclosure explicitly identifies the defect as an incomplete fix for the prior advisory.
Attack Vector
An attacker authenticates to the litellm proxy with any low-privileged virtual key or user credential. The attacker then issues an HTTP request to the ui_view_users endpoint exposed by internal_user_endpoints.py. The server returns user metadata without rejecting the request based on role. No social engineering or user interaction is required, and the attack is fully remote.
A public proof-of-concept demonstrating the request flow is hosted on GitHub Gist, with additional analysis available at VulDB.
Detection Methods for CVE-2026-12799
Indicators of Compromise
- HTTP requests to the litellm ui_view_users route originating from non-administrator API keys or session tokens.
- Unexpected enumeration patterns against /user/list or related management endpoints under internal_user_endpoints.py.
- Spikes in 200-status responses to user management endpoints from accounts that do not normally administer the proxy.
Detection Strategies
- Enable verbose access logging on the litellm proxy and correlate requesting principal roles with the endpoints they invoke.
- Compare the API key or user role attached to each ui_view_users request against an allowlist of administrator identifiers.
- Alert when low-privileged keys access any route under /user/ or other management paths.
Monitoring Recommendations
- Forward litellm proxy logs to a centralized logging or SIEM platform for retention and query.
- Track per-key request rates to management endpoints and flag deviations from baseline behavior.
- Periodically audit issued virtual keys and revoke unused or over-permissioned credentials.
How to Mitigate CVE-2026-12799
Immediate Actions Required
- Upgrade litellm to a release later than 1.82.2 that ships a complete fix for the ui_view_users authorization check.
- Rotate all virtual keys and administrator credentials after upgrading to invalidate any previously harvested tokens.
- Restrict network exposure of the litellm proxy management endpoints to trusted administrative networks where feasible.
Patch Information
At the time of publication, no vendor advisory URL is listed in the NVD record. Monitor the BerriAI litellm GitHub repository for releases addressing the incomplete fix referenced by CVE-2026-12799, and review the VulDB entry for tracking updates.
Workarounds
- Place the litellm proxy behind a reverse proxy or API gateway that enforces administrator-only access to /user/ management routes.
- Issue only narrowly scoped, non-administrator virtual keys to application workloads to limit data exposure if the endpoint is reached.
- Disable the administrative UI in production deployments where it is not required, reducing the attack surface of internal_user_endpoints.py.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
