CVE-2026-92803 LibreTranslate CVE debrief

Who should care

Defenders of instances running LibreTranslate 1.9.6 or earlier should assess exposure and prioritize remediation. They should verify instances of LibreTranslate for version 1.9.6 or earlier and restrict access to the download_file route to prevent data exposure and abuse of ban lists. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-92803 allows unauthenticated access to translated files in LibreTranslate 1.9.6, potentially leading to data exposure and abuse of ban lists. Defenders should verify instances and restrict access to the download_file route.

• Unauthenticated access to translated files may allow data exposure
• Abuse of ban lists may occur without authentication

Technical summary

The download_file route in LibreTranslate 1.9.6 does not have an access check, allowing unauthenticated access to translated files. This vulnerability can be exploited by attackers to bypass API key requirements and abuse ban lists. Defenders should prioritize verifying instances of LibreTranslate for version 1.9.6 or earlier and restrict access to the download_file route to prevent data exposure and abuse of ban lists. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM. The CVE record was published on 2026-09-16T21:17:29.970Z and has not been modified since then.

Defensive priority

Defenders should prioritize verifying instances of LibreTranslate for version 1.9.6 or earlier and restrict access to the download_file route.

Recommended defensive actions

• Verify instances of LibreTranslate for version 1.9.6 or earlier
• Restrict access to the download_file route
• Implement authentication and authorization for file downloads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description states that LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. This information is based on the CVE Program record and the official NIST NVD detail page. Defenders should verify instances of LibreTranslate for version 1.9.6 or earlier and restrict access to the download_file route.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.