CVE-2026-92803 in LibreTranslate
Summary
by MITRE • 09/16/2026
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability in LibreTranslate versions up to 1.9.6 represents a critical failure in access control mechanisms within the web application framework. Specifically, the developers omitted the necessary access_check decorator from the route handling file downloads via the download_file endpoint. In typical API architectures for translation services, endpoints that handle sensitive operations or resource retrieval are protected by authentication middleware that verifies user credentials and validates session tokens before processing requests. The absence of this protective layer on the download functionality creates a direct path for unauthorized data exfiltration. This architectural oversight means that any client capable of reaching the server can invoke the file download routine without providing valid API keys or passing through standard security gates designed to restrict access to authorized users only.
From a technical perspective, this flaw constitutes an Insecure Direct Object Reference combined with Broken Access Control. The application fails to enforce proper restrictions on unauthenticated requests targeting specific resources. Attackers can exploit this by crafting HTTP GET requests directly to the download endpoint URL without including any authentication headers or tokens. Since the server does not validate the identity of the requester for this specific route, it proceeds to generate and serve the translated files as if the request originated from a legitimate, authenticated user session. This bypasses both the API key requirement mechanism intended to rate-limit usage and prevent abuse, as well as any ban lists that might be in place to block malicious actors or excessive traffic sources.
The operational impact of this vulnerability is significant for organizations deploying LibreTranslate instances with sensitive data processing requirements. Unauthenticated access allows adversaries to download translated files containing proprietary information, confidential documents, or personally identifiable information without detection by standard authentication logs. Furthermore, the ability to bypass ban lists means that attackers can evade rate-limiting controls and IP-based restrictions designed to mitigate denial-of-service attacks or scraping activities. This leads to potential data leakage where internal translations are exposed to external parties, compromising confidentiality integrity. Additionally, the abuse of this endpoint for bulk downloading can result in resource exhaustion, impacting service availability for legitimate users by consuming server bandwidth and processing power without accountability.
To remediate this issue, immediate patching is required as version 1.9.7 or later addresses these access control deficiencies by ensuring all routes requiring protection are properly decorated with the necessary authentication middleware. In environments where upgrading is not immediately feasible, administrators should implement network-level controls such as Web Application Firewalls to restrict direct access to the download endpoint based on IP reputation or request patterns. It is also advisable to audit other endpoints for similar omissions of security decorators to ensure comprehensive coverage of access control policies. Regular code reviews focusing on route definitions and decorator application can prevent recurrence of this class of vulnerability, aligning with industry standards such as CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the OWASP Top Ten framework.