---
id: CVE-2024-5710
aliases:
  - GHSA-qqcv-vg9f-5rr3
  - PYSEC-2026-1551
title: litellm vulnerable to improper access control in team management
summary: litellm vulnerable to improper access control in team management
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'
vendor: litellm
product: litellm
ecosystem: pip
affected:
  - litellm < 1.40.15
patched:
  - litellm 1.40.15
published: '2024-06-27'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:15.780180917Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qqcv-vg9f-5rr3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-5710'
  - url: >-
      https://github.com/BerriAI/litellm/commit/da3ae00bd68f451ed8ddf0bc0a9fd34bde5554d6
  - url: >-
      https://github.com/BerriAI/litellm/blob/224148d6133ee50801cb129cbd21ccc213992e25/litellm/proxy/auth/user_api_key_auth.py#L1020
  - url: 'https://github.com/berriai/litellm'
  - url: 'https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970'
tags:
  - osv
  - pip
epss: 0.00406
epssPercentile: 0.32035
ingestedAt: '2026-07-08T18:25:52.470Z'
---

## Overview

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

## Affected packages

- `litellm < 1.40.15`

## Remediation

Upgrade to a patched release:

- `litellm 1.40.15`