CVE-2026-92803

Medium CVSS 5.3

Published 2026-09-16 · last changed 2026-09-17

The fix

We hold no Microsoft remediation data for CVE-2026-92803, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.

Sources

NVD record for CVE-2026-92803

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N