fix(proxy): enforce organization boundaries in admin operations

[stuxf]

Relevant issues

Fixes inconsistent organization boundary checks in team listing and user creation flows.

Reopens #25829 (original base litellm_yj_apr15 was deleted); rebased onto litellm_internal_staging. No content changes.

Pre-Submission checklist

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Type

🐛 Bug Fix

Changes

1. Validate org admin role against all requested organizations

_user_is_org_admin() previously returned True if the caller was admin of any one of the listed organizations. Now validates against all of them — an org admin of org-A cannot perform operations targeting org-B.

2. Scope team list queries to caller's organizations

_build_team_list_where_conditions() previously dropped the organization filter when a user_id parameter was provided, returning teams across all organizations. Now always applies the org filter for org admins.

_authorize_and_filter_teams() (legacy path) previously fetched teams outside the caller's orgs if the target user was a member. Now only returns teams within the caller's permitted organizations.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 17, 2026 0:45am

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...oxy/management_endpoints/organization_endpoints.py	0.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This PR enforces organization boundaries across multiple admin endpoints by fixing six distinct authorization bypass vulnerabilities: (1) _user_is_org_admin changed from "any org" to "all orgs", (2) team list queries now always scope to the org admin's organizations even when user_id is provided, (3) delete_user validates per-target org membership before deletion, (4) /user/update no longer silently creates users for non-PROXY_ADMIN callers, (5) cross-user key modification now requires admin access for non-budget fields, and (6) /organization/member_delete is scoped to org_admin_allowed_routes to prevent unauthorized membership removal.

Confidence Score: 5/5

Safe to merge — all security fixes are correctly implemented and the primary vulnerability paths are covered by tests.

All six authorization bypass fixes are logically correct: the any→all org admin check, batch-fetch org membership before delete_user, silent-create guard, cross-user key update auth, team list org scoping, and the route-level member_delete gate. The only remaining findings are P2: three newly introduced security restrictions (all_users=True, team relocation, org member role protection) lack negative-path tests, but this does not affect correctness or production safety.

tests/test_litellm/proxy/management_endpoints/test_team_endpoints.py — missing negative tests for all_users=True and team relocation security gates.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_checks_organization.py	Fixes _user_is_org_admin to require admin of ALL requested orgs rather than ANY; set comprehension with None-guard is correct.
litellm/proxy/management_endpoints/internal_user_endpoints.py	Adds batch org-membership check before delete_user loop (N+1 addressed) and silent-create guard in _update_single_user_helper; logic is correct.
litellm/proxy/management_endpoints/team_endpoints.py	Scopes team list to org admin's orgs even when user_id filter is provided; adds destination-org check for team relocation; restricts all_users=True to PROXY_ADMIN.
litellm/proxy/management_endpoints/key_management_endpoints.py	Extends key update auth check to all non-budget fields for non-owner callers; preserves owner exemption for non-budget updates.
litellm/proxy/management_endpoints/organization_endpoints.py	Adds guard preventing org admins from modifying the per-org role of a global PROXY_ADMIN user.
litellm/proxy/_types.py	Adds /organization/member_delete to org_admin_allowed_routes to enforce the same route-level gate as member_add/member_update.
tests/test_litellm/proxy/management_endpoints/test_team_endpoints.py	Updates assertion to verify org scoping with user_id filter; formatting refactors; missing negative tests for all_users=True restriction and team relocation guard.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming admin request] --> B{PROXY_ADMIN?}
    B -- Yes --> Z[Permitted]
    B -- No --> C{Route in org_admin_allowed_routes?}
    C -- No --> DENY1[401 Unauthorized]
    C -- Yes --> D{_user_is_org_admin ALL orgs?}
    D -- No --> DENY2[403 Forbidden]
    D -- Yes --> E{Endpoint-specific target check}
    E --> E1[delete_user: batch-fetch target memberships]
    E --> E2[team list v2: WHERE org IN caller_orgs AND team_id IN user_teams]
    E --> E3[key/update: is_key_owner? No = _check_key_admin_access]
    E --> E4[user/update: user exists? No + not PROXY_ADMIN = 404]
    E --> E5[update_team: org relocate? Must be org-admin of destination]
    E --> E6[org member_update: target is PROXY_ADMIN? Only PROXY_ADMIN may modify]
    E --> E7[bulk_team_member_add: all_users=True? Only PROXY_ADMIN]
    E1 --> Z
    E2 --> Z
    E3 --> Z
    E4 --> Z
    E5 --> Z
    E6 --> Z
    E7 --> Z

Loading

_{Reviews (4): Last reviewed commit: "fix(proxy): close /organization member_d..." | Re-trigger Greptile}