scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-13 08:52:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 353

fix: preserve access group restriction when team_id is provided (#23850)

Browse source 
When a key has access_group_ids, resetting key_models=[] on a team_id
query parameter allowed any caller to bypass the access group restriction
via ?team_id=xxx, reverting to full team-level access.

Guard the reset so key_models is only cleared when the key has no
access_group_ids — the access group restriction now stays in force
regardless of the team_id parameter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Jean Carlos Nunez 2026-04-05 14:27:38 -05:00
parent 6c83147f48
commit 7b085e6e4e
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
litellm/proxy/utils.py
View file

@ -5542,9 +5542,13 @@ async def get_available_models_for_user(
# Get team models
team_models: List[str] = user_api_key_dict.team_models
# If specific team_id is provided, validate and get team models
# If specific team_id is provided, validate and get team models.
# Do NOT reset key_models when the key has access_group_ids — the access
# group restriction must remain in force even when a team_id is specified,
# otherwise any caller can bypass it via ?team_id=xxx (issue #23850).
if team_id and prisma_client and proxy_logging_obj and user_api_key_cache:
key_models = []
if not user_api_key_dict.access_group_ids:
key_models = []
team_object = await get_team_object(
team_id=team_id,
prisma_client=prisma_client,