# LiteLLM User-Role Privilege Escalation (CVE-2026-47102)

- **Severity:** Critical
- **Signature ID:** `ed6f136d-6d6b-4819-913b-b970917b7340`
- **CVEs:** CVE-2026-47102
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI03 (Identity and Impersonation), ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

A flaw in LiteLLM's user-management API lets any logged-in user grant themselves administrator rights by directly editing their own role field. This is a critical, easy-to-exploit privilege escalation affecting LiteLLM proxy deployments before version 1.83.10.

## How the attack works

An attacker who already has a low-privilege LiteLLM account (e.g. internal_user) sends a request to the /user/update or /user/bulk_update endpoint. Because these endpoints don't check whether the caller is allowed to change the user_role field, the attacker simply sets it to proxy_admin or admin in the request payload. The bulk_update endpoint also accepts arrays of user objects, so the same trick can escalate one or many accounts in a single call. Once the write is applied, the attacker holds full administrative control of the LiteLLM proxy.

## Why it matters

Full compromise of the LiteLLM proxy: an attacker with any valid low-level account can become a full administrator, exposing API keys, model configurations, spend limits, and every other tenant's data managed through the proxy.

## What you can do

- Upgrade LiteLLM to 1.83.10 or later, where field-level authorization is enforced on user-update endpoints.
- Until patched, restrict or block direct calls to /user/update and /user/bulk_update to trusted admin clients only.
- Audit recent user_role changes in your LiteLLM instance and revoke any unexpected proxy_admin grants.
- Log and alert on any /user/update or /user/bulk_update request where the payload sets user_role to an administrative value, and review it for legitimate admin provisioning versus abuse.

## Known benign look-alikes

- Legitimate proxy_admin provisioning a new administrator through /user/update — expected to match; review confirms intent.
- Security advisory or PR text quoting the CVE-2026-47102 payload.
- User updates that set a non-administrative role (internal_user, internal_user_viewer).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01933
- https://nvd.nist.gov/vuln/detail/CVE-2026-47102

---
Source: https://www.netzilo.com/threats/atr-litellm-user-role-privilege-escalation-cve-2026-47102