Executive brief
LibreTranslate is an open-source machine translation API service that allows organizations to translate text privately. A missing authentication check on the file download endpoint allows attackers to download translated files without an API key on protected instances, bypassing security controls and rate-limiting safeguards designed to prevent abuse.
Technical details
LibreTranslate through version 1.9.6 omits the @access_check decorator from the download_file route handler, creating an authentication bypass vulnerability. The download_file endpoint is reachable over the network without providing valid API credentials, allowing unauthenticated users to retrieve files that should be restricted. An attacker can enumerate and download translated files and bypass configured API key requirements and ban list protections. The vulnerability affects all deployments with API authentication enabled. A fix requires adding the missing access_check decorator to the download_file route in app.py.
Affected products
- LibreTranslate LibreTranslate through 1.9.6
Timeline
- 2026-09-16: disclosed