Is there a public PoC exploit available for CVE-2026-12799?

Yes, a public proof-of-concept exploit is available for CVE-2026-12799. Prioritise patching immediately. EPSS: 0.2%.

BerriAI LiteLLM CVE-2026-12799

Q: What is the CVSS score of CVE-2026-12799?

CVE-2026-12799 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38158 LOW

Improper Authorization (CWE-285)

2026-06-21 VulDB

GHSA-m2v5-74w2-qhcj

Authentication Bypass Litellm Berriai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires low-privilege authentication (PR:L); only limited user data enumeration is possible with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:34 vuln.today

Severity Changed

Jun 21, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 10:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on litellm (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.82.2.

DescriptionCVE.org

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Improper authorization in BerriAI LiteLLM versions up to 1.82.2 allows authenticated low-privilege users to access user data beyond their permitted scope via the ui_view_users management endpoint - an incomplete remediation of the prior CVE-2025-0628 authorization bypass in the same function. A public proof-of-concept exploit is available on GitHub (YLChen-007), confirming practical exploitability. No active exploitation is confirmed (not in CISA KEV), and the authentication requirement (CVSS 4.0 PR:L) constrains the attacker pool to those already holding valid credentials on the target proxy.

Technical ContextAI

LiteLLM (CPE: cpe:2.3:a:berriai:litellm) is an open-source Python proxy and gateway that provides a unified interface for routing API calls to multiple LLM providers such as OpenAI, Anthropic, and others. The vulnerability originates in the ui_view_users function located at litellm/proxy/management_endpoints/internal_user_endpoints.py, which serves the management UI's user listing capability. CWE-285 (Improper Authorization) denotes that the application fails to enforce correct permission boundaries - the function does not adequately verify that the requesting principal is authorized to enumerate or inspect records belonging to other users. The explicit classification as an 'Incomplete Fix CVE-2025-0628' indicates that a prior patch partially addressed an authorization bypass in this same function but left at least one residual bypass path unresolved, a pattern that typically arises when the original fix targeted a specific exploitation vector rather than the underlying access-control logic holistically.

RemediationAI

No vendor-released patched version is independently confirmed at time of analysis - neither the NVD record nor the VulDB advisory cites an explicit fix version. Administrators should monitor the BerriAI LiteLLM GitHub repository and release notes for a version that specifically addresses CVE-2026-12799 as a follow-up to the incomplete CVE-2025-0628 remediation. As an interim compensating control, restrict network access to the LiteLLM proxy management UI endpoints (including the user-listing endpoint) using firewall rules or reverse proxy ACLs, limiting reachability to trusted administrative IP ranges only - this trades off operational convenience for reduced exposure surface. Additionally, enforce authentication and role checks at the reverse proxy layer to prevent low-privilege users from reaching internal management endpoints entirely; note that this adds a dependency on the proxy configuration remaining correct. The public exploit POC at https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184 documents the specific bypass technique and should be reviewed to inform targeted mitigation until an official patch is released.