Security update — upgrade notes
This release includes account recovery and authorization fixes, fresh-install login lockout, gallery privacy and ownership checks, feedback budget enforcement, and integration/email privacy hardening.
Before upgrading:
- Signing secret: public placeholder or short
JWT_SECRETvalues now prevent startup. Use an independently generated secret. If replacing an existing key, plan migration or re-enrollment for encrypted MFA, SSO and recoverable-password values tied to it; existing sessions are invalidated. - Private integrations: add the exact origins required by self-hosted analytics and OIDC to
INTEGRATION_PRIVATE_ORIGINS. Include issuer and discovery-derived token, JWKS and user-info origins as needed. Metadata and link-local destinations remain blocked. - Account recovery: forced password resets permanently revoke existing API keys. The upgrade also revokes keys for accounts already awaiting a forced password change. Issue new keys after recovery.
- Anonymous feedback: existing records remain stored, but previous anonymous browser history is not automatically associated with the new signed identity. Identified guest history is preserved. Rejected feedback attempts consume budget; anonymous counts do not establish one person per vote.
- Mail previews: remote content is blocked by default and can be loaded explicitly for each message.
Use the normal migration-before-start upgrade process. SQLite and PostgreSQL migrations, security regressions, Docker builds, fresh installation and upgrade checks passed for this release change.
Published security advisories
- GHSA-4phv-9qp2-wm5j — High: Known example JWT signing secret accepted at startup
- GHSA-35ff-fgp6-hmg7 — High: User updates bypass account-status authorization and last-admin protection
- GHSA-3qcm-rghc-r5pr — Medium: Fresh installations silently omit account login-lockout storage
- GHSA-cqm4-7634-wccf — Medium: Public link previews expose protected gallery welcome text
- GHSA-hxgm-c9pv-8225 — Medium: Image-security monitoring exposes metadata outside event ownership scope
- GHSA-42p2-rxhw-9crm — Medium: Feedback rate limits trust a client-supplied event identifier
- GHSA-wcw8-5c7q-76qw — Low: Forced password resets leave previously issued API credentials usable