Libretranslate
Monthly
Unauthenticated users can download translated files from LibreTranslate deployments running version 1.9.6 or earlier because the download_file route is missing the access_check decorator, letting requests bypass the API key requirement and ban-list enforcement that operators configured for protected instances (CWE-862 missing authorization). Impact is limited to reading translated file output with no integrity or availability effect, and practical exposure depends on whether download identifiers are predictable or enumerable by the attacker. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS v4.0 base score of 6.9 reflects unauthenticated network reachability combined with low confidentiality impact.
Unauthenticated users can download translated files from LibreTranslate deployments running version 1.9.6 or earlier because the download_file route is missing the access_check decorator, letting requests bypass the API key requirement and ban-list enforcement that operators configured for protected instances (CWE-862 missing authorization). Impact is limited to reading translated file output with no integrity or availability effect, and practical exposure depends on whether download identifiers are predictable or enumerable by the attacker. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS v4.0 base score of 6.9 reflects unauthenticated network reachability combined with low confidentiality impact.