From bdc72651e8338059afb5119c48c999fecbdefcc5 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Fri, 10 Apr 2026 21:01:47 -0700 Subject: [PATCH] fix: restrict all_users bulk update path to proxy admins --- .../proxy/management_endpoints/internal_user_endpoints.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/litellm/proxy/management_endpoints/internal_user_endpoints.py b/litellm/proxy/management_endpoints/internal_user_endpoints.py index 476625f50ae..1772da3d15e 100644 --- a/litellm/proxy/management_endpoints/internal_user_endpoints.py +++ b/litellm/proxy/management_endpoints/internal_user_endpoints.py @@ -1541,6 +1541,12 @@ async def bulk_user_update( ] = [] if data.all_users and data.user_updates: + # Only proxy admins can update all users at once + if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN.value: + raise HTTPException( + status_code=403, + detail="Only proxy admins can update all users at once.", + ) # Optimized path for updating all users directly in database all_users_in_db = await prisma_client.db.litellm_usertable.find_many( order={"created_at": "desc"}