CVE-2026-47102
8.8 HIGHLiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint
Published: 2026-05-21 · Last updated: 2026-06-11
Severity and scoring
- CVSS
- 8.8 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-863
Affected products
| Vendor | Product |
|---|---|
| litellm | litellm |
Description
LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this vulnerability without chaining any additional flaw.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-47102
- [Exploit reference]https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f
- [Patch]https://github.com/BerriAI/litellm/commit/128d32d2494b759c5d15da3452452af4c6a34c01
- [Patch]https://github.com/BerriAI/litellm/commit/e6f18ce75b111c9b93dc15c72894cbdeb53177ce
- [Patch]https://github.com/BerriAI/litellm/pull/25541
- [Other]https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable
- [Exploit reference]https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9
- [Other]https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce
- [Other]https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-user-update
Related CVEs
Same vendor
- CVE-2026-47101 — LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit (8.8 HIGH)
- CVE-2026-42271 — LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format (8.8 HIGH)
Same CWE
- CVE-2026-53860 — OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries... (4.2 MEDIUM)
- CVE-2026-53855 — OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks ... (8.1 HIGH)
- CVE-2026-53854 — OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows sender... (6.5 MEDIUM)
- CVE-2026-53853 — OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowe... (8.3 HIGH)
- CVE-2026-5149 — The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the g... (6.5 MEDIUM)