BerriAI LiteLLM EUVD-2026-38158

Exploitation requires valid credentials with at least low-level privilege on the target LiteLLM proxy instance, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated attackers cannot trigger this vulnerability. The proxy must be deployed with the management UI or internal user endpoints network-accessible to the attacker. The specific vulnerable code path is the ui_view_users function in the internal user management module of the proxy component; deployments that do not expose management endpoints externally (e.g., management UI bound to localhost only) are not reachable from remote attackers. Exploitation is further bounded by impact: only low confidentiality exposure (user record enumeration) is achievable - no write, delete, or availability impact is possible through this vector. The incomplete-fix nature implies a prior authorization check was patched in CVE-2025-0628, so attackers must use the residual bypass path documented in the public POC rather than the original technique.

The CVSS 4.0 base score of 2.1 is low, reflecting the authentication prerequisite (PR:L), absence of integrity or availability impact (VI:N/VA:N), and only limited confidentiality exposure (VC:L). The E:P supplemental metric confirms a publicly available exploit, which meaningfully elevates practical risk above what the numeric score alone conveys - defenders should not dismiss this solely on score. The absence of a CISA KEV listing and the requirement for prior authenticated access significantly narrow the realistic attacker population to insiders, compromised-credential holders, or users who have obtained low-privilege accounts through other means. The incomplete-fix lineage of this CVE is a mild concern: repeat bypass vulnerabilities in the same function suggest the authorization logic may warrant a deeper architectural review rather than another point patch. No EPSS score was provided in the input data, so probabilistic exploitation frequency cannot be quantified from available signals. The overall assessment is moderate urgency - not a drop-everything emergency, but should be patched promptly given POC availability and the sensitivity of user enumeration in an LLM proxy context.

An attacker holding a low-privilege account on a LiteLLM proxy deployment - such as a regular API user or a compromised service account - sends a crafted request to the ui_view_users management endpoint, exploiting the residual authorization bypass left by the incomplete CVE-2025-0628 fix to enumerate user records beyond their permitted scope. A public proof-of-concept on GitHub lowers the technical barrier significantly, making this accessible to script-level attackers. The harvested user metadata (usernames, roles, API key associations) could support follow-on attacks such as targeted credential stuffing or privilege escalation within the LiteLLM environment.