From 28f43a7a3789e8b55ec496b464eb428296cb0018 Mon Sep 17 00:00:00 2001 From: Ryan Crabbe Date: Fri, 24 Apr 2026 19:47:58 -0700 Subject: [PATCH] fix(rbac): also gate /key/service-account/generate for org admins /key/service-account/generate is in org_admin_allowed_routes (via key_management_routes), so without this check an org admin could bypass disable_key_generate_for_org_admin by calling the service-account endpoint instead. --- litellm/proxy/management_endpoints/key_management_endpoints.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py index 4b8cf1dbe99..1fdf62cdb5b 100644 --- a/litellm/proxy/management_endpoints/key_management_endpoints.py +++ b/litellm/proxy/management_endpoints/key_management_endpoints.py @@ -1454,6 +1454,8 @@ async def generate_service_account_key_fn( detail={"error": CommonProxyErrors.db_not_connected_error.value}, ) + await check_org_admin_can_generate_keys(user_api_key_dict=user_api_key_dict) + await validate_team_id_used_in_service_account_request( team_id=data.team_id, prisma_client=prisma_client,