CVE-2026-92803

MEDIUM 5.3

LibreTranslate through 1.9.6 Missing Access Check on the download_file Route

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.

CWE	CWE-862
Vendor	libretranslate
Product	libretranslate
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for libretranslate libretranslate

Be the first to know when new medium vulnerabilities affecting libretranslate libretranslate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

LibreTranslate / LibreTranslate

0 ≤ 1.9.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/LibreTranslate/LibreTranslate/issues/1012 github.com: https://github.com/LibreTranslate/LibreTranslate github.com: https://github.com/LibreTranslate/LibreTranslate/blob/v1.9.6/libretranslate/app.py#L1029-L1030 vulncheck.com: https://www.vulncheck.com/advisories/libretranslate-through-1.9.6-missing-access-check-on-the-download-file-route

Credits

George Chen