CVE-2026-12799: BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or restrict network access to the litellm proxy management endpoint that implements ui_view_users (file: litellm/proxy/management_endpoints/internal_user_endpoints.py). Use firewall rules, network ACLs, or a WAF to allow only trusted administrative IP addresses or internal network segments to reach that endpoint (mitigates exploitation of CVE-2025-0628).
- Operational
Audit logs and access records for calls to ui_view_users (internal_user_endpoints.py) to detect potential exploitation of CVE-2025-0628. For any accounts showing suspicious or unauthorized access, rotate credentials, invalidate active sessions/tokens, and perform additional incident-response steps as required.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12799?
The severity of CVE-2026-12799 is medium with a score of 4.3.
What does CVE-2026-12799 affect?
CVE-2026-12799 affects the function ui_view_users in the file internal_user_endpoints.py of BerriAI litellm up to version 1.82.2.
How does CVE-2026-12799 vulnerability occur?
CVE-2026-12799 occurs due to improper authorization stemming from an incomplete fix of CVE-2025-0628.
How can I mitigate CVE-2026-12799?
To mitigate CVE-2026-12799, updating to the latest version of BerriAI litellm that addresses this issue is recommended.
What are the consequences of CVE-2026-12799?
The consequences of CVE-2026-12799 include potential unauthorized access to user information within the affected application.