LiteLLM versions prior to 1.83.10 expose an endpoint capable of updating a user’s own profile. While the /user/update endpoint correctly limits updates to the requester’s account, it fails to restrict which profile fields can be modified. An attacker can therefore alter the user_role field and claim the proxy_admin role, giving them comprehensive administrative access over all users, teams, keys, models, and prompt history. The weakness stems from a lack of field‑level authorization checks (CWE‑863).

The vulnerability affects BerriAI’s LiteLLM application, specifically all releases earlier than version 1.83.10. Any deployment of these impacted versions is susceptible if the /user/update endpoint is exposed to authenticated users.

With a CVSS score of 8.7, the vulnerability is considered high risk. Although no EPSS score is available, the flaw enables direct privilege escalation without chaining additional vulnerabilities, and users with the org_admin role can exploit it immediately. Because the endpoint is accessible to legitimate users within the application, the risk of exploitation is significant, especially in environments where the /user/update route is exposed without additional safeguards. The defect is not listed in the CISA KEV catalog but its severity and the ability to leverage existing authenticated sessions make it a compelling target for attackers.