LiteLLM User-Role Privilege Escalation (CVE-2026-47102) - ATR-2026-01933 (b35726cc-da0f-5777-a5c8-1bbf41558c24)
Detects CVE-2026-47102 (CVSS 9.9 chain, CWE-269): LiteLLM's user-management endpoints /user/update and /user/bulk_update modify security-sensitive fields without field-level authorization. A low-privilege authenticated caller (e.g. internal_user) can write the user_role field directly and self-promote to proxy_admin, gaining full administrative control of the LiteLLM proxy. Affected: LiteLLM before 1.83.10. Detection covers: (a) /user/update or /user/bulk_update payload that sets user_role to an administrative role (proxy_admin / admin); (b) the bulk_update array form where a user object escalates user_role; (c) explicit CVE-2026-47102 exploitation framing. The detection target is the request shape — an admin-role write at the user-update endpoint — which is the exact privilege-escalation primitive, caught before the proxy applies the role change.