litellm - 💡(How to fix) Fix [Bug]: /customer/daily/activity exposes cross-tenant end-user spend to any authenticated key

Check for existing issues

• I have searched the existing issues and checked that my issue is not a duplicate. (Closely related: #19194 for the same disclosure shape on /user/daily/activity, which was fixed in 0f98f3754f. The /customer/daily/activity endpoint was missed.)

What happened?

The /customer/daily/activity endpoint (and its alias /end_user/daily/activity) performs no role check. Any authenticated caller — including service-account keys (user_id=None) and ordinary personal keys — can omit the end_user_ids query parameter and receive daily spend, token counts, and model breakdown for every end-user across all tenants.

Root cause: when end_user_ids is omitted, end_user_ids_list = None is passed down to get_daily_activity(entity_id=None, ...). The shared _build_where_conditions helper (in litellm/proxy/management_endpoints/common_daily_activity.py) treats entity_id=None as "no filter on this column", so the query degenerates to a full-table read over LiteLLM_DailyEndUserSpend.

This is the same disclosure shape that was fixed for /user/daily/activity in commit 0f98f3754f (the prior issue is #19194). The customer endpoint shares the same underlying builder but was not patched in that change.

LiteLLM_EndUserTable has no per-tenant ownership column, so there is no safe non-admin scoping for this endpoint — the sibling /customer/list endpoint is already admin-only for the same reason. /customer/daily/activity should match.

Affected deployments: any LiteLLM proxy that uses the end-user feature (per-user billing, metering, customer tracking) and has issued more than one key. The leak surfaces customer IDs and per-customer spend, which is commonly PII and/or commercially sensitive.

Steps to Reproduce

1. Deploy LiteLLM proxy with at least one end-user created (POST /end_user/new) and some spend logged against it.
2. From any non-admin authenticated key (a personal key, team key, or service-account key — none require admin role):

curl -H \"Authorization: Bearer sk-<any-key>\" \\
  \"http://<proxy>/customer/daily/activity?start_date=2024-01-01&end_date=2024-12-31\"

1. Observe that the response includes spend rows for end-users created by other tenants / other keys, not just data scoped to the calling key's tenant.

Relevant log output

What part of LiteLLM is this about?

Proxy

What LiteLLM version are you on ?

Reproducible on current main (verified at commit 79b4578671). The handler has had no admin check since the endpoint was introduced.

Twitter / LinkedIn details

No response