CVE-2026-12799 Details
Description
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
An improper authorization vulnerability has been identified in BerriAI Litellm versions up to 1.82.2. The issue arises in the 'ui_view_users' function within 'litellm/proxy/management_endpoints/internal_user_endpoints.py'. This vulnerability, an incomplete fix for CVE-2025-0628, allows low-privileged users to bypass authorization checks and access sensitive user information. The vulnerability can be exploited remotely, and has been publicly disclosed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/811291 | CISA-ADP | Third Party AdvisoryExploitVDB Entry |
| https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184 | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/cve/CVE-2026-12799 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/submit/811291 | [email protected] | Third Party AdvisoryExploitVDB Entry |
| https://vuldb.com/vuln/372561 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/372561/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| litellm litellm | <= 1.82.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 21, 2026 | New CVE Received | [email protected] |