CVE-2024-5710

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-57116.1A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloa CVE-2024-57128.1A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vul CVE-2024-57135.4The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outpu CVE-2024-57146.8In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate pr CVE-2024-57157.1The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a R CVE-2024-571516.8SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php CVE-2024-571527.5Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication CVE-2024-571549.8Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/CVE-2024-571559.8Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token.CVE-2024-571579.8Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.CVE-2024-571593.507FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/add.html.CVE-2024-57169.8Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on