CVE-2024-5710: Improper Access Control in Team Management in berriai/litellm

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-27 · updated 2026-06-17
Weakness: CWE-862

Description

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

Affected products

BerriAI litellm: 1.34.34

References

https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970
https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970

Get alerted when CVE-2024-5710 or the next vulnerability affects your stack