This release adds local user management, personal profiles, centralized allowlist visibility, and new OIDC options, alongside authentication security fixes and improved WebSocket stability.
New features
- User management: Administrators can create local accounts with admin or read-only roles, change roles, disable accounts, reset passwords and authentication methods, and delete users. Safeguards protect the last active administrator, and management actions are audit logged. (#557)
- Personal profiles: The new Settings → Profile tab brings together language, font, sidebar visibility, password, TOTP, and passkey settings. Display preferences follow each account across browsers and remain editable in read-only mode.
- Allowlists: Browse CrowdSec centralized allowlists, search entries, check IPs and ranges, and compare differences across instances. Manual decisions matching an allowlist require explicit Bypass allowlist confirmation, with bypasses recorded in the audit log. (#556)
- OIDC auto-login and back-channel logout: Optionally redirect users straight to the identity provider and end dashboard sessions when the provider sends a signed logout notification. (#555)
Settings improvements
- Reorganized Settings into General, Profile, Authentication, Users, and Branding tabs, with role-appropriate access.
- Added tab links, keyboard navigation, and a single Save button per settings tab. Unsaved changes survive switching tabs.
- Moved manual decision scenarios into General.
- Settings explicitly supplied through
config.yamlorCONFIG_*variables now take precedence over saved UI values. Locked controls identify the configuration source. - Updated translations, documentation, and screenshots.
Upgrade notes
- Existing databases migrate automatically on startup.
- Explicit configuration values now override previously saved Settings values. To unlock a setting, remove it from both YAML and environment configuration, then restart.
- OIDC auto-login and back-channel logout are disabled by default. Auto-login requires configured OIDC with password login disabled.
- Provider end-session logout now defaults to off for new OIDC setups; installations already using OIDC retain the previous default.
- Allowlist checks do not block manual decisions when a target LAPI does not support allowlists or cannot be checked.
Changes
- Add OIDC auto-login and back-channel logout (#555) (#558)
- Lock settings that the application config manages (#558)
- Add read-only allowlists view and allowlist protection for manual decisions (#558)
- Split Settings into tabs with one Save button per tab (#558)
- Add user management and per-user account settings (#557) (#558)
- Fix authentication, outbound request security and WebSocket crashes (#558)
- Move manual decision scenarios into the General settings tab (#558)
- Rename the My account settings tab to Profile and refresh screenshots (#558)
Contributors
Docker
docker pull ghcr.io/TheDuffman85/crowdsec-web-ui:2026.10.12