LiteLLM Privilege Escalation: User Role Manipulation Grants Admin Access (CVE-2026-47102)

A critical vulnerability, CVE-2026-47102, has been identified in LiteLLM versions prior to 1.83.10. The National Vulnerability Database reports that this flaw allows an authenticated user to escalate their privileges to proxy_admin via the /user/update endpoint. While the endpoint correctly restricts users to modifying only their own account, it fails to validate which fields can be updated. This oversight enables a malicious actor to directly change their user_role attribute.

The impact is severe: gaining proxy_admin access grants full administrative control over the LiteLLM instance. This includes unfettered access to all user accounts, teams, API keys, model configurations, and sensitive prompt history. The National Vulnerability Database assigns this a CVSSv3.1 score of 8.8 (HIGH), underscoring the ease of exploitation and the extensive compromise possible. Notably, users with the org_admin role already have legitimate access to this endpoint, making exploitation trivial without requiring additional attack chaining.

This is a straightforward privilege escalation that attackers will absolutely leverage. The attacker’s calculus is simple: get a low-privilege account, hit the update endpoint, and own the entire environment. Defenders need to understand that this isn’t some complex zero-day — it’s a basic authorization bypass that has massive implications for data confidentiality and system integrity.