From 9a9323022f5096c467cabbe0343b8e0129688075 Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta01.pally@gmail.com>
Date: Tue, 5 May 2026 12:11:51 +0000
Subject: [PATCH] fix: V-003 security vulnerability

Automated security fix generated by Orbis Security AI
---
 litellm/proxy/proxy_server.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index a5905765c6e..5a182fd4e92 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -11008,6 +11008,10 @@ async def model_info_v2(
             sort_by=sortBy,
         )
 
+    # Enforce RBAC: non-admin users should only see their accessible models
+    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
+        user_models_only = True
+
     if user_models_only:
         all_models = await non_admin_all_models(
             all_models=all_models,