8 views
-/https://github.com/berriai/litellm/issues/27294
GitHub · issue

#27294 [Bug]: org_admin user receives 401 on POST /team/update despite being authorized

  • State: open
  • Author: @Luke213-app
  • Labels: bug, proxy

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

An `org_admin` user (configured via `LiteLLM_OrganizationMembership` with `user_role = "org_admin"`) receives `401 Authentication Error` when calling `POST /team/update`, even though `/team/update` is listed in `LiteLLMRoutes.org_admin_allowed_routes` and the endpoint's own authorization check (`_verify_team_access`) correctly handles org admins.

The root cause is in the **proxy auth pipeline**: `non_proxy_admin_allowed_routes_check` rejects the request before the handler runs because the org-admin route-gate helper requires the request body to contain `organization_id`, but `UpdateTeamRequest` makes that field optional and the typical caller passes only `team_id`.

The same gap likely affects `/team/delete`, `/team/block`, and `/team/unblock`, which also rely on `_verify_team_access` and are not in `self_managed_routes`.

## Root Cause Analysis

### The bug: `_user_is_org_admin` returns False when no `organization_id` is in the request body

In `litellm/proxy/auth/auth_checks_organization.py:142-180`:

```python def _user_is_org_admin( re…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 · 31d18h37m49s ago — entered · #import:https:::github.com:berriai:litellm post #2534
The right-side change requires a new external authentication flow, secure credential exchange, token lifecycle and refresh handling, provider integration, configuration, compatibility testing, and likely broader SDK/proxy coverage. The left-side change is a localized authorization-pipeline correction with focused regression tests and a narrower risk surface.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search