From 64daf17449589052eb3be4d6a11bdccd2a3af39f Mon Sep 17 00:00:00 2001
From: shivam <shivam@berri.ai>
Date: Sat, 25 Apr 2026 14:29:06 -0700
Subject: [PATCH] fix(vector_stores): restrict vector store and index deletion
 to proxy admins only

Non-admin keys could delete vector stores via DELETE /v1/vector_stores/{id}
and delete Azure AI Search indexes via the azure_ai pass-through endpoint.
Added PROXY_ADMIN checks to both paths (registered-index and generic fallthrough).

Made-with: Cursor
---
 .../llm_passthrough_endpoints.py                | 17 +++++++++++++++++
 .../proxy/vector_store_endpoints/endpoints.py   | 11 ++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
index 418715cb9cd..00bbbe0aa4e 100644
--- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
+++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
@@ -47,6 +47,7 @@ from litellm.types.passthrough_endpoints.pass_through_endpoints import (
 )
 from litellm.proxy.utils import is_known_model
 from litellm.proxy.vector_store_endpoints.utils import (
+    _is_proxy_admin,
     is_allowed_to_call_vector_store_endpoint,
 )
 from litellm.secret_managers.main import get_secret_str
@@ -1369,6 +1370,14 @@ async def azure_proxy_route(
                     ),
                 )
             elif is_vector_store_index:
+                if request.method == "DELETE" and not _is_proxy_admin(
+                    user_api_key_dict
+                ):
+                    raise HTTPException(
+                        status_code=403,
+                        detail="Only proxy admins can delete vector store indexes.",
+                    )
+
                 # get the api key from the provider config
                 provider_config = (
                     ProviderConfigManager.get_provider_vector_stores_config(
@@ -1428,6 +1437,14 @@ async def azure_proxy_route(
                     extra_headers=cast(dict, extra_headers),
                 )
 
+    if request.method == "DELETE" and "indexes" in endpoint and not _is_proxy_admin(
+        user_api_key_dict
+    ):
+        raise HTTPException(
+            status_code=403,
+            detail="Only proxy admins can delete vector store indexes.",
+        )
+
     base_target_url = get_secret_str(secret_name="AZURE_API_BASE")
     if base_target_url is None:
         raise Exception(
diff --git a/litellm/proxy/vector_store_endpoints/endpoints.py b/litellm/proxy/vector_store_endpoints/endpoints.py
index 1fdfad8c96c..d30e5d30b36 100644
--- a/litellm/proxy/vector_store_endpoints/endpoints.py
+++ b/litellm/proxy/vector_store_endpoints/endpoints.py
@@ -10,7 +10,10 @@ from litellm.proxy._types import CommonProxyErrors, UserAPIKeyAuth
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
 from litellm.proxy.common_request_processing import ProxyBaseLLMRequestProcessing
 from litellm.proxy.utils import jsonify_object
-from litellm.proxy.vector_store_endpoints.utils import can_user_access_vector_store
+from litellm.proxy.vector_store_endpoints.utils import (
+    _is_proxy_admin,
+    can_user_access_vector_store,
+)
 from litellm.types.vector_stores import IndexCreateRequest
 
 router = APIRouter()
@@ -498,6 +501,12 @@ async def vector_store_delete(
     API Reference:
     https://platform.openai.com/docs/api-reference/vector-stores/delete
     """
+    if not _is_proxy_admin(user_api_key_dict):
+        raise HTTPException(
+            status_code=403,
+            detail="Only proxy admins can delete vector stores.",
+        )
+
     from litellm.proxy.proxy_server import (
         general_settings,
         llm_router,