CVE-2024-5710: berriai berriai/litellm Missing Authorization

Vulnerability summary

CVE-2024-5710 is a medium (CVSS 6.5) Missing Authorization vulnerability in berriai berriai/litellm. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-06-2024
   PublishedVulnerability first disclosed.
2. 15-10-2025
   Last modifiedVulnerability information updated.

Description

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.