LibreTranslate through version 1.9.6 fails to enforce an access check on the download_file route, which allows anyone to retrieve translated files without providing a valid API key or authentication token. This vulnerability is identified as a missing authorization check (CWE‑862) and can be exploited to bypass restrictions such as API key enforcement and ban lists, potentially exposing sensitive translation data or abuse of protected instances.

LibreTranslate instances running version 1.9.6 or earlier are affected. The product is the LibreTranslate translation engine provided by the LibreTranslate project.

The flaw has a CVSS score of 6.9, indicating a moderate severity level. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the time of this analysis, and the issue is not currently listed in the CISA KEV catalog. The most common attack path is a direct HTTP request to the download_file endpoint, which can be performed by any client with network access to the instance, including unauthenticated external users. No additional privileges or pre‑existing conditions are required beyond the ability to reach the endpoint.