CVE-2026-92803: LibreTranslate through 1.9.6 Missing Access Check on the download_file Route
LibreTranslate through 1.9.6 omits the accesscheck decorator from the downloadfile route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated file downloads?
Protected LibreTranslate instances that rely on API key requirements or ban lists to restrict access to translated files are exposed. The affected download_file route omits the access_check decorator.
What does an attacker need to exploit this issue?
An attacker can access the affected download_file route over the network without authentication. No API key or prior authorization is required to bypass the route's intended access controls.
What is the impact of successful exploitation?
An attacker can download translated files from an affected instance. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.