CVE-2026-92803 | BDVDB-2026-375513 Detail
LibreTranslateLibreTranslate
Description#
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://github.com/LibreTranslate/LibreTranslate/issues/1012
- https://github.com/LibreTranslate/LibreTranslate
- https://github.com/LibreTranslate/LibreTranslate/blob/v1.9.6/libretranslate/app.py#L1029-L1030
- https://www.vulncheck.com/advisories/libretranslate-through-1.9.6-missing-access-check-on-the-download-file-route
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.