{"id":"CVE-2026-92803","title":"LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files","summary":"LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without auth…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-862"],"vendor":"LibreTranslate","product":"LibreTranslate","affected":["LibreTranslate <= 1.9.6"],"published":"2026-09-16","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:53:07.383","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92803","references":[{"url":"https://github.com/LibreTranslate/LibreTranslate","label":"disclosure@vulncheck.com"},{"url":"https://github.com/LibreTranslate/LibreTranslate/blob/v1.9.6/libretranslate/app.py#L1029-L1030","label":"disclosure@vulncheck.com"},{"url":"https://github.com/LibreTranslate/LibreTranslate/issues/1012","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libretranslate-through-1.9.6-missing-access-check-on-the-download-file-route","label":"disclosure@vulncheck.com"},{"url":"https://github.com/LibreTranslate/LibreTranslate/issues/1012","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00406,"epssPercentile":0.3462,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T14:59:01.047492Z"},"ingestedAt":"2026-09-16T21:05:36.884Z","slug":"CVE-2026-92803","body":"## Overview\n\nLibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":206157,"id":"CVE-2026-92803","ts":1789658479762,"field":"exploit_available","old":"false","new":"true"}]}