Who Is He

Song: https://youtu.be/SLNqxQXMV1w?si=M3l6Zz4GffohF-OZ

Passbolt 5.15.0 improves form detection for autofill, makes permission changes easier to review, and adds several security and administration improvements. This release also introduces new session management tooling and additional safeguards for Passbolt Pro.

Clearer permission confirmation changes

Permission changes are now easier to understand before they take effect, helping users avoid accidental access changes. New badges clearly show whether a permission is being added, modified, or deleted, so users can see exactly what will change at a glance.

Deleted permissions can also be rolled back to their original state before confirmation, making access changes easier to review and adjust.

Improved autofill detection

Autofill now works more reliably on modern websites that were previously unsupported. Improved form detection helps users fill credentials more consistently and with less manual effort, resulting in a smoother autofill experience.

This is the first step in a broader series of autofill improvements, with upcoming releases focused on reducing false positives and further refining form classification. A technical blog article explaining those improvements in detail will be published after the next release.

Security

Invalidate JSON authentication token for disabled users

Disabling a user now cuts off their access straight away when they are signed in with JWT authentication, as was already the case for other authentication methods. Previously, a user who had just been disabled could keep using the API for up to 5 minutes. Only the mobile application and power users with a custom API integration were affected.

Last login dates only available for administrators

Privacy has also been strengthened by restricting users' last login dates to administrators only, reducing unnecessary exposure of sensitive account activity.

SCIM administrators protected against deletion (Pro Edition)

SCIM providers can no longer delete Passbolt administrators by default, helping prevent an identity provider from accidentally locking an administrator out.

Organisations that intentionally manage administrator removal through SCIM can disable this protection by updating their configuration.

If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:

[...]
// plugins configuration.
'plugins' => [
    'scim' => [
        'security' => [
            'allowDeleteAdministrators' => true
        ]
    ],
],
[...]

If you installed Passbolt with docker, you can use the following environment variable:

PASSBOLT_PLUGINS_SCIM_SECURITY_ALLOW_DELETE_ADMINISTRATORS=true

SSRF protection for SSO provider URLs (Pro Edition)

SSO provider integration is now blocked from accessing internal or private network addresses, reducing the risk of malicious or misconfigured redirects. A new healthcheck flags when the protection is disabled. It remains off by default for backward compatibility and will become the default in a future release.

Organizations that would want to enforce it could already do it by configuration.

If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:

[...]
'security' => [
    'sso' => [
        'egress' => [
            // Master switch for the SSRF guard
            'enabled' => true,
            // Enforce vs. warn-only
            // true blocks the connection
            // false logs a warning but still connects
            'block' => true,
            // Turn the always-blocked category on/off (link-local + cloud metadata)
            'blockLinkLocal' => true,
            // Turn the private-range category on/off (loopback, RFC1918, unique local addresses, carrier-grade NAT)
            'blockPrivateRanges' => true,
            // Exact IPs allowed to bypass the private-range block only (never link-local/metadata)
            // Comma-separated string, i.e. '10.10.5.20, 10.10.5.21'
            'privateRangeAllowedIps' => null,
        ],
    ],
],
[...]

If you installed Passbolt with docker:

PASSBOLT_SECURITY_SSO_EGRESS_GUARD_ENABLED=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_ENABLED=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_LINK_LOCAL=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_PRIVATE_RANGES=true
PASSBOLT_SECURITY_SSO_EGRESS_PRIVATE_RANGE_ALLOWED_IPS="10.10.5.20, 10.10.5.21"

Performance and database-stored sessions (Beta)

Warning: this feature is still in beta and is not recommended for production use. If you do try it, we would be glad to hear your feedback. Keep in mind that enabling this feature can increase your server load, so consider it carefully before doing so.

Passbolt API can now store sessions in the database, improving performance by removing file-based session locking and simplifying high-availability deployments.

Administrators that want to test can enable the feature manually via configuration:

Update Session.defaults configuration in the passbolt.php file:

[...]
'Session' => [
        [...]
        'defaults' => 'database', // Set this to database
    ],
[...]

Or if you installed Passbolt with docker, set SESSION_DEFAULTS env var:

SESSION_DEFAULTS=database

Miscellaneous Improvements

Administrators are now notified whenever any user is deleted, giving them better visibility into account removals across the organisation. Previously, notifications were sent only when an administrator was deleted.

Conclusion

Many thanks to Luca Crippa for the security report on the JSON authentication token issue, Ashik Mohamed for the report on the SCIM administrator issue, and meifukun for the report on SSRF protection for SSO provider URLs, and to everyone who provided feedback, reported bugs, and contributed to making passbolt better!

Changelog

Check out the changelog to learn more about additional improvements and fixes.

Added

• PB-53238 Adds a healthcheck to warn users about PHP 8.2 end of life
• PB-53302 Adds a V5150CreateSessionsTable migration to support database session storage
• PB-53303 Adds a PurgeSessions command to prune expired database sessions
• PB-53547 Adds a V5150AddSessionsModifiedIndex migration to speed up session cleanup
• PB-53548 Adds a healthcheck entry reporting which session provider the application is using
• PB-53639 Adds a healthcheck warning admins the SSO egress guard is off and will default on in the next version
• PB-53885 Adds an allowDeleteAdministrators configuration to guard SCIM administrator deletion

Fixed

• PB-44325 Hides the "last logged in" timestamp for non-admins from the API
• PB-49590 Extends the admin-deletion email notification to also fire when a non-admin user is deleted
• PB-52221 HTML-escapes SMTP trace data in the webinstaller before rendering
• PB-52453 Closes personal-folder sharing bypass via blank metadata_key_type (Aikido#31150196)
• PB-52454 Blocks non-admin promotion of a V5 personal tag to shared via PUT /tags/{id} (Aikido#31150196)
• PB-52456 Blocks non-owner from unlinking shared V5 tags via POST /resources/{id}/tags (Aikido#31150196)
• PB-53146 Removes stack traces from missing-route exception responses
• PB-53180 Preserves historical permission levels in the activity log by no longer overwriting permissions_history on update
• PB-53260 Preserves resource tags and favorite information when one of a user's accesses is revoked but not all
• PB-53561 Rejects JWT tokens for disabled users
• PB-53563 Excludes sessions from the SQL dump command
• PB-53567 Rejects invisible characters in role names
• PB-53725 Fixes SessionPreventExtensionMiddleware creating a phantom session row for unauthenticated requests when SESSION_DEFAULTS=database
• PB-53815 Rejects invisible characters in group names, profile fields, resource names, folder names, and tag slugs

Security

• PB-53111 Makes single-use authentication-token consumption atomic to prevent concurrent replay
• PB-53210 Fixes security vulnerability advisories affecting the guzzlehttp/guzzle package (AIKIDO-2026-231561, GHSA-wm3w-8rrp-j577, AIKIDO-2026-793560, GHSA-94pj-82f3-465w)
• PB-53215 Fixes SSO Provider URL allowing private-network SSRF (MFK-01)
• PB-53223 Fixes stored XSS in the Account-Recovery Policy Update email (MFK-06)
• PB-53357 Upgrades js-yaml (GCVE-0-2026-59869)
• PB-53780 Upgrades squizlabs/php_codesniffer to 3.13.6 (CVE-2026-67434)
• PB-53952 Upgrades js-yaml (GHSA-5p4m-2wfm-xmqj)

Maintenance

• PB-51984 Removes remaining differences in the Webinstaller between CE and PRO repositories (MEP WP 7.2)
• PB-53119 Migrates SettingsIndexController logic into a dedicated Service layer
• PB-53270 Updates release version in file headers of the new user finders/tests (HLL)
• PB-53407 Upgrades CakePHP to v5.4.1
• PB-53453 Upgrades guzzlehttp/guzzle to 7.15.2
• PB-53655 Removes the config/schema/sessions.sql file
• PB-53874 Wires plugin table associations via Model.initialize instead of plugin bootstrap()
• Renovate: Update dependency phpstan/phpstan to v1.12.34
• Renovate: Update dependency duosecurity/duo_universal_php to v1.2.0
• Renovate: Update dependency cakephp/authentication to v3.3.7
• Renovate: Update dependency league/flysystem to v3.35.2
• Renovate: Update dependency league/oauth2-client to v2.9.0
• Renovate: Update dependency ramsey/uuid to v4.9.3
• Renovate: Update dependency spomky-labs/otphp to v11.5.0
• Renovate: Update dependency firebase/php-jwt to v7.1.0
• Renovate: Update adminer:standalone Docker digest

Going Backwards

Song: https://youtu.be/pIqrmGKfmQU

Passbolt 5.14.3 addresses issues identified after the 5.14 release.

Following the introduction of the permission confirmation dialog in 5.14, two behaviors needed correction. The dialog appeared when editing only the metadata of a shared resource, such as renaming it, even though no secret was changed. It now appears only when the secret is modified. Additionally, when creating a resource in a shared folder where the user is not the owner, the dialog allowed editing the permissions inherited from the parent folder, potentially overriding the access structure established by the organization. The dialog now opens in read-only mode in this situation, allowing the user to review permissions and group members before proceeding without overriding the permissions. Users authorized to manage access can still update permissions directly.

Additionally, the in-form menu could appear even when disabled on the API by feature flag. The API could in some cases return plugin configuration in an unexpected format, and the browser extension would fall back to enabling any plugin whose setting did not strictly match. Both the API and the browser extension now enforce a strict format, and the in-form menu correctly reflects the settings.

Finally, a separate regression prevented the API from running over HTTP. While this is not recommended, the regression could break testing or staging instances not using HTTPS.

Many thanks to everyone who reported these issues.

Changelogs

Fixed

• PB-53457 Fix env()-backed config flags to enforce strict boolean type
• PB-53498 Fix CSRF cookie not working over HTTP deployments

Sunshine

Song: https://youtu.be/JfP3sB-hke4

Passbolt 5.14.0 Sunshine introduces explicit permission confirmation prompts to improve control over shared resources. This release also addresses a security issue related to MFA policy enforcement and includes usability improvements.

Sharing transparency

Users now receive an explicit confirmation dialog before creating items in shared folders or editing shared resources. This provides full permission transparency before changes take effect, preventing accidental privilege exposure.

In addition, when a group appeared in the access list, its individual members were not visible, making it difficult to assess the actual reach of shared access. Group members are now displayed directly within the dialog.

As the first stage of a broader security initiative, future updates will extend these confirmations to folder move operations and offer enhanced permission preview dialogs.

Edition and Subscription Management

The Passbolt edition is now visible in the application footer, and Terms & Credits links have moved to the main navigation menu.

Additionally, whenever administrators downgrade to the Community edition they will be explained the impact on data and feature beforehand so they can make an informed decision.

Resource Suggestions

Suggested resources in the browser extension are now ranked using an improved URL relevance algorithm. Exact URL matches appear first, followed by parent paths and domain matches, allowing users to select the correct credentials faster and with fewer autofill errors.

Security Improvements

This release addresses a low-severity vulnerability that allowed a user with a valid account and MFA access to remember their device for a month even when the organisation had disabled that option. Reported by security researcher Damir, the issue affected Passbolt API versions up to 5.13.0 and is now enforced correctly at the API level in 5.14.0.

Additional Improvements

Passbolt Pro extends email-free account setup and recovery to OIDC and ADFS SSO providers, improving onboarding by integrating directly with enterprise identity management systems.

Finally, this release lays the foundational backend architecture required for upcoming offline functionality.

Conclusion

Many thanks to Damir and everyone who provided feedback, reported bugs, and contributed to making Passbolt better!

Changelogs

Added

• PB-49943 Add a model cache health check service
• PB-50621 Add recover flow support for OAuth2 & ADFS SSO providers
• PB-52153 Add a command to insert dummy data into the email_queue table
• PB-52421 Add more verbose logs when an SSO provider response is in an incorrect format

Fixed

• PB-48004 Fix deprecation warnings in makeCsrfCookieSecureIfRequestIsSsl
• PB-52585 Fix resource sharing after inserting dummy data
• PB-52727 Fix typo in SSO settings activated email
• PB-52952 Return 400 instead of 409 when the email is not found in the expected place from a SCIM IdP
• PB-52592 Fix account recovery response email not being sent to custom RBAC roles

Security

• PB-29515 Fix MFA remember me policy bypass (INC-2046)
• PB-32421 Validate and filter user-edit request data via a modeless form instead of UsersEditController::_validateRequestData
• PB-51819 Upgrade composer/composer (AIKIDO-2026-688935)
• PB-52440 Fix a disabled TOTP provider still being able to mint an MFA verification cookie via non-JSON /mfa/verify/totp
• PB-52441 Fix refresh-token rotation being replayable concurrently due to non-atomic consumption
• PB-52452 Harden secret revocation on share
• PB-52457 Block renaming of reserved roles to close a delete-protection bypass
• PB-52461 Fix last-resource-type guard incorrectly counting soft-deleted rows
• PB-52463 Restrict filter[is-deleted] on the resource-types index to admins only
• PB-52538 Upgrade js-yaml
• PB-52599 Upgrade spomky-labs/otphp (GHSA-g7m4-839x-ch6v, GHSA-2jx3-65f3-xr8r)
• PB-52687 Fix composer security advisory affecting the cakephp/authentication package (CVE-2026-55590)
• PB-52695 Fix Aikido advisory in the guzzlehttp/guzzle library (AIKIDO-2026-646305)
• PB-52696 Upgrade phpseclib/phpseclib (GHSA-m557-wrgg-6rp4)
• PB-53143 Update CakePHP version to 5.3.7

Maintenance

• PB-50620 Move the SSO Azure stage3.php template to success/stage3.php
• PB-52146 Allow additional database drivers to be registered in the healthcheck via dependency injection
• PB-52285 Add test to verify JWT refresh token behaviour with a suspended user
• PB-52553 Add PostgreSQL support to the create_passbolt_db script
• Renovate: Update dependency bacon/bacon-qr-code to v3.1.1
• Renovate: Update dependency cakephp/debug_kit to v5.2.4
• Renovate: Update dependency cakephp/plugin-installer to v2.0.2
• Renovate: Update dependency composer/composer to v2.10.2
• Renovate: Update dependency directorytree/ldaprecord to v3.8.6
• Renovate: Update dependency donatj/phpuseragentparser to v1.12.0
• Renovate: Update dependency ergebnis/phpunit-slow-test-detector to v2.24.0
• Renovate: Update dependency imagine/imagine to v1.5.4
• Renovate: Update dependency phpstan/phpstan to v1.12.33
• Renovate: Update dependency phpunit/phpunit to v11.5.55
• Renovate: Update dependency psalm/phar to v6.16.1
• Renovate: Update dependency seec/phpunit-consecutive-params to v1.2

I Feel Love

Song: https://youtu.be/G9XeQqyog54

Passbolt 5.13.0 is a maintenance release that introduces in-app edition management. Administrators can now switch between the Community and Pro editions without manual migrations. It also includes scalability and monitoring improvements for larger deployments, security updates, and bug fixes.

In-app edition management

Until now, administrators running the Community Edition who wanted to evaluate Pro features had to set up a separate environment or run manual migrations. With the codebase unification shipped in 5.12 and the edition management introduced in 5.13, they can now upgrade or downgrade directly from the organisation settings.

The entire project remains open source under the AGPL-3.0 licence, and the Community edition will always be free. A dedicated blog post with more details on this choice will follow.

Scalability and monitoring

Administrators who monitor their instance through the healthcheck status endpoint (/healthcheck/status.json) will get a more complete signal. This endpoint now verifies the availability of the caching system.

For organisations that manage large numbers of credentials, the browser extension now starts paginating resource fetching, which reduces server load. This is part of a continuous effort to improve passbolt scalability, with folder pagination being next in line.

Maintenance and security

This release fixes a number of bugs, among them an issue that prevented Firefox users from creating TOTPs from uploaded QR codes. It also ships third-party dependency upgrades and security advisory fixes. Check the detailed logs below for the full list.

Conclusion

Many thanks to everyone who provided feedback, reported bugs, and contributed to making passbolt better!

Changelog

Added

• PB-42980 As an administrator I can upgrade my Passbolt CE instance to a Pro edition from the product
• PB-42980 As an administrator I can downgrade my Passbolt Pro instance back to CE from the product
• PB-51980 Adds a healthcheck that reports the edition currently served by the instance
• PB-51533 As an admin I can contain my_group_user in PUT /groups.json
• PB-52020 As an administrator I can run the healthcheck command if the DB is not reachable
• PB-51039 Extends the /healthcheck/status.json endpoint to verify additional components such as the cache

Fixed

• PB-51161 Stops folder cycle detection at the personal folder boundary
• PB-50013 Fixes user session being destroyed in Safari when fetching avatar images from the web application
• PB-52027 Fixes SCIM endpoints returning non-standard HTTP status codes
• PB-51646 Fixes missing spaces in the email sent when a user lost their key/passphrase and recovery is aborted

Security

• PB-52135 Upgrades mobiledetect/mobiledetectlib
• PB-51940 Fixes qs security vulnerability advisory GHSA-q8mj-m7cp-5q26 (Medium)
• PB-51639 Fixes PKSA-pwvr-3754-v57r security vulnerability advisory affecting composer/composer package
• PB-51194 PBL-15-006: Fixes internal UUID still disclosed in SCIM user creation conflict response (Low)

Maintenance

• PB-51650 Introduces ScimSettingsDto for the ScimGetSettingsService::getSettings()
• PB-51647 Adds unit tests for GroupsUsersTable::isManager()
• PB-52010 Removes cakephp/bake from composer dev requirements
• PB-52126 Upgrades symfony/string to 7.4.13
• PB-51570 Upgrades CakePHP to v5.3.6 and replaces _execute() calls with process() to fix deprecations
• PB-52070 Fixes "Use expr() instead of newExpr()" deprecation warning after CakePHP upgrade
• PB-48002 Removes security.prompt from the SSO configuration
• PB-49755 Removes GitLab CI definition (moved to the ci-definitions repository)
• PB-49425 Refactors DirectorySync controller tests using fixture factories
• PB-35955 Refactors /healthcheck/status.json endpoint to use a pluggable default status strategy

Natural Blues

Song: https://youtu.be/0udIM6eooUA

Passbolt 5.12.0 makes the Safari browser extension generally available, ending the open beta period. This release also introduces a new PIN code resource type, along with improvements to TOTP field detection and the usual round of security and dependency updates.

Safari Extension Out of Beta

The Safari extension is now offered by default to all Safari users, on equal footing with Chrome, Firefox, and Edge.

This milestone reflects months of work across both our internal testing and the open beta period, during which organisations enabled the extension on their own instances and gave feedback. Many thanks to everyone who joined the TestFlight program for the open beta. Your feedback shaped this release.

PIN code resource type

Passbolt 5.12 introduces a dedicated Pin Code resource type for securely storing standalone PINs such as door access codes, safes, alarm systems, SIM codes, or device unlock codes.

Unlike workarounds based on passwords or custom fields, Pin Codes now have their own dedicated form, icon, validation, and generation flow. PINs are strictly numeric and support 4 to 12 digits in accordance with the ISO 9564-1 standard.

Users can create, view, copy, and generate PIN codes directly from the browser extension, optionally alongside a secure note. A dedicated PIN code column can also be displayed in the resource grid, while administrators can enable or disable the resource type from the administration settings.

Import and export are supported, with automatic detection of compatible PIN code entries during import.

This release also lays the groundwork for additional resource types in future releases.

Maintenance and security

As usual, this release ships some third-party dependency upgrades and security advisory fixes, with no user-visible impact.

The release also refines the browser extension's detection of TOTP fields to reduce false positives in autofill. Many thanks to the community members who reported cases where the extension picked up unintended fields. Clearly integrating with the wide variety of forms across the web is a community effort, and your feedback is what makes it possible.

For administrators, the action logs purge command now covers additional entries, improving the audit logs performance.

Conclusion

Many thanks to everyone who tried the Safari open beta, reported autofill issues, and contributed to making Passbolt better.

What’s next

Passbolt is also preparing for offline mode support, allowing users to securely access encrypted resources even when temporarily disconnected from the server. More details will be shared in upcoming releases!

[5.12.0] - 2026-05-12

Added

• PB-51081 Adds pin code resource type
• PB-51516 Enables Safari by default

Security

• PB-50625 Fixes GHSA-f886-m6hf-6m8v security vulnerability advisory (Medium)
• PB-50340 Upgrades picomatch package (Medium)
• PB-50538 Upgrades lodash package (Critical)
• PB-50895 Fixes bn.js security vulnerability advisory GHSA-378v-28hj-76wf (Medium)
• PB-50969 Fixes composer security vulnerability advisory affecting phpseclib/phpseclib package (CVE-2026-40194)
• PB-51135 Fixes security vulnerability advisory affecting composer/composer package (CVE-2026-40261, CVE-2026-40176)
• PB-51151 Fixes i18next-http-backend security vulnerability advisory GHSA-r5fr-rjxr-66jc (Medium)
• PB-51152 Fixes uuid security vulnerability advisory GHSA-w5hq-g745-h8pq (Medium)
• PB-51448 Fixes security vulnerability advisory affecting phpseclib/phpseclib package (CVE-2026-44167)
• PB-51208 Cleans up UserScimResource.php logged errors
• PB-51028 Sets SESSION_COOKIE_SAMESITE on Lax by default for all session engines

Maintenance

• PB-50893 As an administrator I can purge action additional logs by action via the logs purge command
• PB-50914 Homogenizes CE and Pro codebase
• PB-51243 Fixes activity logging breaking after instance reset while executing Selenium tests
• PB-51428 Fixes dev test data inserting empty definitions for v5 resource types
• PB-51541 Fixes SCIM endpoints returning 500 errors on cloud when resourceType is not supported

v5.11.0

Passbolt 5.11.0 "Got To be Real" marks SCIM provisioning as production-ready following an external security audit by Cure53. This release also adds PingOne as a new SSO provider and introduces OAuth support for SMTP authentication with Microsoft Exchange Online, ahead of Microsoft's planned deprecation of basic authentication at the end of 2026.

SCIM: audit fixes and general availability (Passbolt Pro)

SCIM provisioning, introduced as beta in Passbolt 5.5.0, is now marked as stable. With SCIM, administrators can create, update, suspend, and delete users directly from their identity provider, without ever touching the Passbolt UI. Microsoft Entra ID and Okta have been tested and validated as supported providers.

This milestone follows an external security audit conducted by Cure53, whose findings have been addressed across this and previous releases. The full report will be published shortly and made available to the community.

PingOne SSO support (Passbolt Pro)

This release adds PingOne as a new SSO provider. Organisations using PingOne can now authenticate their users without leaving their existing identity infrastructure.

PingOne joins the list of supported SSO providers alongside Azure AD, AD FS, Google, and the generic OpenID Connect connector that supports providers such as Keycloak or other in-house identity systems.

SMTP OAuth support for Microsoft Exchange Online

This release introduces OAuth 2.0 support for SMTP email delivery with Microsoft Exchange Online. Microsoft has announced that basic authentication for SMTP will be disabled by default at the end of 2026 (see Microsoft's updated deprecation timeline). Organisations using Exchange Online can start transitioning to OAuth now, ahead of the deadline.

Safari update (beta)

The Safari extension moves to its next milestone. While still in beta, organisations can now opt in by enabling a feature flag in the API configuration file or via environment variable. Once enabled, the browser extension becomes available through what will become the stable package on the Apple Store, allowing organisations to deploy it for all their users.

Safari support is not yet fit for production use. For more details about the known limitations and risks, see the open beta announcement. We thank the community members participating in the TestFlight program for their continued feedback and encourage pioneers who are comfortable with the risk to enable it and share their experience.

To enable safari beta from the environment variables, set the PASSBOLT_PLUGINS_SAFARI_ENABLED to true.

To enable safari beta from the passbolt.php configuration file.

'passbolt' => [
  'plugins' => [
    'safari' => [
      'enabled' => true,
    ],
  ],
],

Other changes

This release adds autofill support for ProxMox, OVH, Supermicro IPMI, and several other websites. We continuously work to improve autofill coverage and the feedback from the community is invaluable. If you encounter a website where autofill does not work as expected, do not hesitate to file a bug report.

As usual, the release is also packed with additional improvements and fixes. Check out the detailed logs to learn more.

Conclusion

Many thanks to everyone who provided feedback, reported bugs, and contributed to making passbolt better!

Changelog

Added

• PB-49875 OAuth support for smtp authentication
• PB-50158 Add a feature flag to enable/disable Safari availability on a Passbolt instance
• PB-50199 As an admin I can contain my_group_user in POST /groups.json
• PB-50646 Add Permissions-Policy header on the API response
• PB-32992 [Pro] As a user I can use PingOne as single sign on provider
• PB-50524 [Pro] Move SCIM feature out of beta

Fixed

• PB-49323 As a user creating a resource, I should not get a 500 if the secret passed is not an array of secrets
• PB-40266 Health-check issues on Ubuntu 24 when running while being in a directory without the +x permission bit for www-data user (GITHUB #571)
• PB-50021 As a guest, I should not get a 500 on GET /users.json?contain[pending_account_recovery_request]=1
• PB-49823 Fix misleading email notification footer
• PB-50028 GITHUB - Fix GPG authentication nonce UUID validation using incorrect comparison operand (#592, #596)
• PB-50121 Replace rand() with a static counter to generate unique bind-parameter placeholder (GITHUB #595)
• PB-50241 As a logged-in user I should not get a 500 when logging-in again
• PB-49902 As a user I cannot create a v4 resource with v5 resource type
• PB-49286 [Pro] PBL-15-009 WP4: Non-transactional group member operations (Low)
• PB-49160 [Pro] PBL-15-012 WP1: Potential admin lockout via malicious IdP request (Low)
• PB-49159 [Pro] PBL-15-011 WP4: Lack of transaction wrapper in production sync (Low)
• PB-49285 [Pro] PBL-15-008 WP4: ScimEntry uniqueness race condition (Medium)
• PB-49284 [Pro] PBL-15-007 WP5: Potential DoS via pre-authentication GPG decryption (Low)
• PB-49151 [Pro] PBL-15-003 WP3: Lack of bearer token expiry & revocation schemes (Medium)
• PB-50646 - Add Permissions-Policy header on the API response

Improved

• PB-50070 Align X-Frame-Options with CSP and add missing X-XSS-Protection header

Maintenance

• PB-50133 Align allowCsvFormat variable name in plugin config.php
• PB-50173 Fix composer security vulnerability advisory affecting phpseclib/phpseclib package (CVE-2026-32935)
• PB-49096 Remove unused MFA assets & pages served by the browser extension

You've Got the Love

Release song: https://www.youtube.com/watch?v=9Nv-WHmjN7s

Passbolt 5.10 “You've Got the Love” introduces the first Safari-compatible version of the Passbolt browser extension. The extension is currently available as a beta preview for testers who want to try it and provide feedback ahead of the stable release. This version also brings new productivity features such as TOTP autofill and tags visible in the grid, along with security hardening and performance improvements.

Safari beta support (TestFlight preview)

Passbolt 5.10 introduces the first Safari-compatible version of the Passbolt browser extension. The Safari extension is currently available as a build distributed through TestFlight via this public link for users who want to try it and provide feedback ahead of the stable release. The extension is currently distributed this way while work continues toward a stable Safari release.

Learn how to get started with the Safari beta in the dedicated guide.

TOTP autofill

Users can now autofill one-time passwords (TOTP) directly in login forms, similar to how usernames and passwords are autofilled.

When a webpage contains a TOTP field, Passbolt detects it and proposes relevant resources that contain a configured TOTP secret.
Users can then select the resource to fill the current one-time password directly into the form.

TOTP autofill can be triggered either from the in-form menu or from the Quick Access interface, allowing users to complete multi-factor authentication without manually copying codes between applications.

Tags visible in the grid (Passbolt Pro)

Tags are now displayed directly in the resources grid, making it easier to identify and filter resources without opening the resource details view.

A new tags column shows the tags associated with each resource. Tags are displayed in alphabetical order and remain clickable, allowing users to filter the workspace by selecting a tag directly from the grid.

When multiple tags exist, the grid displays as many as possible within the column width and indicates additional tags using a counter with a tooltip showing the remaining tags.

This update also modernises the tag codebase and lays the groundwork for further improvements to tagging capabilities.

Security improvements

Passbolt team is currently preparing its First Level Security Certification (CSPN) with the French National Cybersecurity Agency (ANSSI). This release includes some fixes following the CSPN pre-audit evaluation done in partnership with Quarkslab and an external audit of SCIM provisioning by Cure53. This release addresses the findings identified during both audits.

One notable issue is around CSV injection, e.g. when CSV exports could be susceptible to formula injection when opened in spreadsheet software. This issue was known and classified as out of scope, as exported CSV files are not intended to be opened in spreadsheets but with the password manager they were generated for. However we revisited this decision and settled for a security-by-default approach: CSV export is now disabled by default, fixing the bigger problem of credentials being potentially exported in plaintext. Organisations that still rely on it can re-enable the feature through configuration. Encrypted KDBX export remains available and is the recommended format for credential portability. Looking ahead, we plan to support the FIDO CFX format in a future release to further standardise credential import and export across tools.

Content Security Policy enforcement has been extended to close remaining gaps, further reducing the attack surface in case of a breach. Because the browser extension serves its own code locally rather than relying on the API, sensitive operations were already well protected by design against server-side injection.

Additionally an external security audit of SCIM provisioning has been completed, and this release includes fixes for a number of the findings. We are actively working through the remaining issues and will publish the full audit results once that work is done. SCIM will exit beta and ship on Passbolt Cloud as soon as all findings are resolved.

Maintenance & performance

This release brings a major upgrade to React 18, resulting in up to 20% faster rendering and the elimination of rare visual glitches that could cause flashes during navigation.

First load times have also improved substantially. Large organisations with thousands of resources will notice the biggest difference, with initial data processing now up to 20% faster.

Bear with us, more optimisations are already in the pipeline for future releases.

Conclusion

As usual, the release is also packed with additional improvements and fixes. Check out the changelog to learn more.

Many thanks to everyone who provided feedback, reported bugs, and contributed to making passbolt better!

Changelog

Added

• PB-48415 As an administrator, I can define the export policies to prevent CSV Export RCE
• PB-45576 As a logged-in user, the user ID only should be stored in session
• PB-24273 GET /auth/logout endpoint is now disabled by default
• PB-48148 Enforces content security policy

Fixed

• PB-48092 Fixes incorrect client IP in error logs by moving HttpProxyMiddleware upper in the middlewares chain
• PB-48208 POST /mfa/verify/yubikey should not trigger 500
• PB-43183 Improve folders cascade delete performance by refactoring code using iterative BFS and batch operations
• PB-49323 As a user creating a resource, I should not get a 500 if the secret passed is not an array of secrets
• [PRO] PB-47973 As an administrator I can synchronize with active directory longer entries in order to support 2 or more bytes alphabets
• [PRO] PB-49152 PBL-15-004 WP1: Fixes unsalted SHA256 hashing of bearer tokens in SCIM
• [PRO] PB-49148 PBL-15-002 WP3: Fixes suboptimal token generation randomness of SCIM bearer token
• [PRO] PB-49153 PBL-15-005 WP2: Fixes race condition in SCIM user creation endpoint
• [PRO] PB-49158 PBL-15-010 WP4: Fixes directory entry foreign key race condition

Security

• [PRO] PB-49154 PBL-15-006 WP2: Disable user enumeration via error messages on SCIM user creation endpoint

Maintenance

• PB-48556 Fixes CVE-2026-25129 security vulnerability advisory for psy/psysh package
• PB-47677 Upgrades firebase/php-jwt to version v7.0.0
• PB-47628 Upgrades cakephp/cakephp to v5.2.12
• PB-48555 Fix CVE-2026-24765 security vulnerability advisory for phpunit/phpunit package
• PB-48396 Update composer/composer package to 2.9.5 to fix CVE CVE-2026-24739 in symfony/process package

Flight Facilities

Release song: https://www.youtube.com/watch?v=QNa5o85Q-FE

Passbolt 5.9 is a maintenance release. It expands runtime compatibility with PHP 8.5. It contains additional health checks, and closes a couple of security gaps around user enumeration and click jacking.

Warning: If you run MariaDB 10.3 or 10.5, or MySQL 5, pay particular attention to the environment section below.
Support for these versions is planned to stop in January 2027, and this release starts flagging them as end of life.

Environment support and early deprecation notice

Passbolt 5.9 adds PHP 8.5 support, helping administrators and platform teams validate upcoming runtime upgrades in advance.
Moreover, while PHP 8.2 is still supported until 2027, it has entered security maintenance, and administrators should plan its upgrade this year.

At the same time, this release improves environment health checks to surface database versions that have reached end of life. MariaDB 10.3 and 10.5, and MySQL 5, are now flagged as deprecated allowing administrators to identify risky deployments during routine maintenance rather than responding under time pressure. These notices are tied to a planned end of support in January 2027.

Safer account recovery responses to reduce email enumeration risk

Account recovery endpoints can reveal whether a user exists, which makes targeted attacks easier. In Passbolt 5.9, the recover endpoint no longer leaks information when a user does not exist in the database.

Stronger protection against clickjacking and deceptive overlays

Clickjacking and overlay techniques aim to trick users into clicking something different from what they believe they are interacting with. Passbolt 5.9 reinforces defenses against these UI-level attacks in edge-case conditions, including scenarios where a compromised website tries to influence user interactions when a password could be suggested.

In practice, this extra layer of strengthening helps ensure users cannot be guided into interacting with sensitive Passbolt components when those components are not fully visible and clearly presented to them.

Better visibility and efficiency around email digest operations

Large folder operations can generate a lot of email activity and can be difficult to reason about as queues grow. Passbolt 5.9 improves digest handling related to folder operations, helping reduce unnecessary mail churn in workspaces where folder structure and permissions evolve frequently.

In addition, the passbolt email_digest command now reports how many emails were sent and how many remain in the queue. This makes it easier for administrators to confirm progress, anticipate bursts, and troubleshoot queue behavior using logs.

Maintenance work that improves stability over time

Passbolt 5.9 continues the migration work to React 18. The first part of the application have been migrated. This is a larger foundational effort that will improve stability and long-term performance.

Conclusion

This release also includes additional fixes and improvements as seen below. Thanks to the community members and teams who reported issues and helped validate fixes.

[5.9.0] - 2026-01-26

Added

• PB-44749 As an administrator I should get notified in the healthcheck about the deprecation of the database type and version
• PB-47893 As an administrator running the bin/cron command, I can see in the logs the number of emails left to send
• PB-46111 As a user I should receive a single email digest when more than one folders are created, updated or deleted

Fixed

• PB-47991 As an administrator I should not get a data-check error for deleted resources with no active metadata keys
• PB-47987 As an administrator I should not get a data-check error for deleted secrets

Security

• PB-47276 As a non-logged in user I cannot enumerate user emails using the recover endpoint

Maintenance

• PB-47701 Specify 1.1.0 version as minimum duo universal SDK package version in composer.json
• PB-47794 Update composer/composer to fix security-check job due to CVE-2025-67746

Everything in its Right Place

Release song: https://www.youtube.com/watch?v=F5uXomY94w8

Passbolt 5.8.0 introduces dynamic role management, allowing organizations to define additional roles that better align with internal policies, compliance requirements, and operational needs. This release also adds drag & drop user assignment to groups, simplifying day-to-day user and group management.

Warning: Ensure that all users have updated their browser extension to at least version 5.8 before assigning new roles. Otherwise, they will not be able to connect to Passbolt.

Dynamic role management

As was already the case with the default User role, Passbolt allows administrators to restrict what users can do by limiting access to specific capabilities. With version 5.8, this model is extended beyond the default Admin and User roles, making it possible to create additional roles and assign them to users for more granular control.

Dynamic roles also enable the delegation of administrative responsibilities. Rather than granting full administrative access, administrators can now assign selected capabilities to custom roles and distribute operational tasks across multiple users. Initial support covers group creation, as well as handling account recovery requests in Passbolt Pro.

At this stage, dynamic role management comes with a defined scope and set of constraints.

• The default Admin and User roles keep fixed names and cannot be renamed or deleted.
• As before, the User role can be restricted, but it cannot be assigned delegated administrative responsibilities.
• The Admin role, by contrast, always retains access to all capabilities and cannot be restricted.
• Custom roles are currently limited to two per instance and support a first set of administrative capabilities.

This scope will be expanded progressively as additional needs and use cases are identified by the community.

Drag & drop users to groups

Managing group membership often requires repetitive actions when working with large teams or frequently changing group structures. With Passbolt 5.8, administrators can now add users to a group by dragging them directly onto it from the Users & Groups workspace. This removes the need to open and edit each group individually and makes day-to-day group management faster and more fluid.

Miscellaneous improvements

As usual, this release includes fixes and smaller improvements intended to improve the overall experience. For the full list of changes, please refer to the changelog.

Many thanks to everyone who provided feedback and helped refine these features.

[5.8.0] - 2025-12-22

Added

• PB-46972 As an administrator I can create a new custom role
• PB-46973 As an administrator I can update a custom role
• PB-46968 As an administrator I can soft delete custom roles
• PB-46971 As an administrator I can list roles including deleted ones via filter
• PB-47169 As a user I receive an email notification when my role is changed
• PB-47345 As an administrator I receive an email notification when a role is created or updated
• PB-46975 As an administrator I can list RBACs including Actions
• PB-46976 As an administrator I can update RBACs for Actions
• PB-47006 As a logged-in user my role is fetched on every request to reflect role changes immediately
• PB-47083 As a user with appropriate RBAC permissions I can create groups
• PB-47196 As an administrator I can run the healthcheck command in POSIX mode
• PB-47274 As an administrator I can run a command to populate created_by and modified_by fields in secrets
• PB-47275 As an administrator I can run a command to populate secret revisions for existing secrets

Fixed

• PB-46374 As first admin I should not receive emails regarding encrypted metadata enablement during the first setup
• PB-46613 Fix web installer not working in HTTP when not in secure context
• PB-46640 Fix warnings in mfa_user_settings_reset_self.php email template
• PB-46645 Optimize action logs purge command dry run query
• PB-46913 Fix MfaUserSettingsDisableCommand to support case sensitive username comparison
• PB-46935 Fix 500 error on /metadata/session-keys/{uuid}.json endpoint when the request is sent twice
• PB-47236 Reduce the PHP memory load of the V570PopulateSecretRevisionsForExistingSecrets migration

Security

• PB-46890 Upgrade js-yaml dependency (Medium severity)

Maintenance

• PB-45979 Add CACHE_CAKETRANSLATIONS_CLASSNAME environment variable for cake_translations cache config
• PB-46388 Fix PHPUnit 11 deprecations

Gnossienne No. 1

Release song: https://youtu.be/t12nOxmB278

Passbolt 5.7.2 fixes an issue introduced in v5.7.0 that affected the health check when it was run after the cleanup command.
The bug caused the server metadata private key to be incorrectly deleted, resulting in health check failures.
This has now been resolved, and the cleanup process works as expected.

We thank the community again for reporting this issue!

[5.7.2] - 2025-11-17

Fixed

• PB-46826 As an administrator running the cleanup task, the server metadata private key entry should not be deleted