BerriAI/litellm · error · HTTPException

Only PROXY_ADMIN may modify the organization role of a user

Error message

Only PROXY_ADMIN may modify the organization role of a user who is a global PROXY_ADMIN.

What it means

A privilege-boundary guard: the target user holds the global PROXY_ADMIN role, and the code refuses to let any non-proxy-admin (including org admins) mutate that user's per-organization role, because changing it would corrupt admin UI filtering and scope derivation. The at-fault input is a role-change request aimed at a PROXY_ADMIN user by a lesser-privileged caller.

Source

Thrown at litellm/proxy/management_endpoints/organization_endpoints.py:1378

                },
            )
        if existing_organization_membership is None:
            raise HTTPException(
                status_code=404,
                detail={"error": f"Member not found in organization for user_id={data.user_id}"},
            )

        # Reject attempts to change the role of a global PROXY_ADMIN via
        # org-scoped operations. An org-admin of any org could otherwise
        # alter a PROXY_ADMIN user's per-org role, which has downstream
        # effects on admin UI filtering and scope derivation.
        target_user_row = await _table(UserRepository(prisma_client)).find_unique(where={"user_id": data.user_id})
        if target_user_row is not None and getattr(target_user_row, "user_role", None) in (
            LitellmUserRoles.PROXY_ADMIN.value,
            LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
        ):
            if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN.value:
                raise HTTPException(
                    status_code=403,
                    detail={
                        "error": (
                            "Only PROXY_ADMIN may modify the organization role of a user who is a global PROXY_ADMIN."
                        )
                    },
                )

        # Update member role
        if data.role is not None:
            await _table(OrganizationMembershipRepository(prisma_client)).update(
                where={
                    "user_id_organization_id": {
                        "user_id": data.user_id,
                        "organization_id": data.organization_id,
                    }
                },
                data={"user_role": data.role},

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use a PROXY_ADMIN key to modify the organization role of a global PROXY_ADMIN user.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/organization_endpoints.py:1378 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/b0f8b15ff899dc46. Report an issue: GitHub.