CVE-2026-92803 LibreTranslate through 1.9.6 Missing Access Check on the download_file Route
Unauthenticated attackers can bypass API key requirements to download translated files from protected LibreTranslate instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92803?
CVE-2026-92803 is a medium-severity missing authorization vulnerability in LibreTranslate, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.
Weakness: CWE-862
Which versions are affected by CVE-2026-92803?
How do I fix CVE-2026-92803?
No fix has been published for CVE-2026-92803 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92803 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92803 exists.
Sources
Also known as GHSA-9p4g-9hh7-7mj3.