CVE-2024-5710 Improper Access Control in Team Management in berriai/litellm

What is CVE-2024-5710?

CVE-2024-5710 is a medium-severity missing authorization vulnerability in berriai/litellm, published on 27 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

Weakness: CWE-862

Which versions are affected by CVE-2024-5710?

3 open source packages ship an affected version, including litellm. It affects 1 product.

Products include Litellm Litellm.

How do I fix CVE-2024-5710?

Upgrade litellm to 1.40.15 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-5710 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5710 exists.

Other vulnerabilities in berriai/litellm

• CVE-2026-42208 BerriAI LiteLLM SQL Injection Exploited Critical 9.3
• CVE-2026-59822 BerriAI LiteLLM Improper Authentication Exploited High 8.8
• CVE-2026-42271 BerriAI LiteLLM Command Injection Exploited High 8.7
• CVE-2024-5751 Remote Code Execution in BerriAI/litellm Critical 9.8
• CVE-2024-2952 Server-Side Template Injection in BerriAI/litellm Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qqcv-vg9f-5rr3, PYSEC-2026-1551.