LiteLLM, a proxy server for calling LLM APIs, had an authorization flaw in its /config/update endpoint before version 1.83.0. The endpoint did not enforce admin role checks, enabling authenticated users to alter proxy configurations and environment variables. Attackers could register custom pass-through handlers pointing to malicious Python code to achieve remote code execution, read arbitrary server files by manipulating UI_LOGO_PATH, and hijack privileged accounts by changing UI_USERNAME and UI_PASSWORD environment variables. The issue is tracked as CWE-863 (Incorrect Authorization) and carries a CVSS 4.0 score of 8.7, indicating high severity. The vulnerability was fixed in LiteLLM version 1.83.0.

An authenticated user without admin privileges can exploit this vulnerability to execute arbitrary code on the server, read sensitive files, and take over privileged accounts. This compromises the confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical impact on system security if exploited.

Upgrade LiteLLM to version 1.83.0 or later, where the authorization checks on the /config/update endpoint are properly enforced. Since no official patch link or vendor advisory was provided, verify the upgrade from the official BerriAI sources. Until upgraded, restrict access to authenticated users and monitor for suspicious activity related to configuration changes.