LibreTranslate versions through 1.9.6 have a vulnerability where the download_file route lacks the access_check decorator. This omission allows unauthenticated users to access and download translated files, bypassing API key requirements and ban lists on protected instances. The vulnerability has a medium severity with a CVSS score of 5.3.