CVE-2025-0628

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-06294.8The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allo CVE-2025-06306.5Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authe CVE-2025-06318.7A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in c CVE-2025-06329.2Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensiti CVE-2025-06335.1Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory CVE-2025-06349.8Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.CVE-2025-06357.5Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resource CVE-2025-06368.4EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited lead CVE-2025-06379.8It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This defi CVE-2025-06387.5The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked wh CVE-2025-06397.5An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7 CVE-2025-06404.7Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. This issue affects Octo