passbolt/passbolt_api v5.15.0

Who Is He

on GitHub

Song: https://youtu.be/SLNqxQXMV1w?si=M3l6Zz4GffohF-OZ

Passbolt 5.15.0 improves form detection for autofill, makes permission changes easier to review, and adds several security and administration improvements. This release also introduces new session management tooling and additional safeguards for Passbolt Pro.

Clearer permission confirmation changes

Permission changes are now easier to understand before they take effect, helping users avoid accidental access changes. New badges clearly show whether a permission is being added, modified, or deleted, so users can see exactly what will change at a glance.

Deleted permissions can also be rolled back to their original state before confirmation, making access changes easier to review and adjust.

Improved autofill detection

Autofill now works more reliably on modern websites that were previously unsupported. Improved form detection helps users fill credentials more consistently and with less manual effort, resulting in a smoother autofill experience.

This is the first step in a broader series of autofill improvements, with upcoming releases focused on reducing false positives and further refining form classification. A technical blog article explaining those improvements in detail will be published after the next release.

Security

Invalidate JSON authentication token for disabled users

Disabling a user now cuts off their access straight away when they are signed in with JWT authentication, as was already the case for other authentication methods. Previously, a user who had just been disabled could keep using the API for up to 5 minutes. Only the mobile application and power users with a custom API integration were affected.

Last login dates only available for administrators

Privacy has also been strengthened by restricting users' last login dates to administrators only, reducing unnecessary exposure of sensitive account activity.

SCIM administrators protected against deletion (Pro Edition)

SCIM providers can no longer delete Passbolt administrators by default, helping prevent an identity provider from accidentally locking an administrator out.

Organisations that intentionally manage administrator removal through SCIM can disable this protection by updating their configuration.

If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:

[...]
// plugins configuration.
'plugins' => [
    'scim' => [
        'security' => [
            'allowDeleteAdministrators' => true
        ]
    ],
],
[...]

If you installed Passbolt with docker, you can use the following environment variable:

PASSBOLT_PLUGINS_SCIM_SECURITY_ALLOW_DELETE_ADMINISTRATORS=true

SSRF protection for SSO provider URLs (Pro Edition)

SSO provider integration is now blocked from accessing internal or private network addresses, reducing the risk of malicious or misconfigured redirects. A new healthcheck flags when the protection is disabled. It remains off by default for backward compatibility and will become the default in a future release.

Organizations that would want to enforce it could already do it by configuration.

If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:

[...]
'security' => [
    'sso' => [
        'egress' => [
            // Master switch for the SSRF guard
            'enabled' => true,
            // Enforce vs. warn-only
            // true blocks the connection
            // false logs a warning but still connects
            'block' => true,
            // Turn the always-blocked category on/off (link-local + cloud metadata)
            'blockLinkLocal' => true,
            // Turn the private-range category on/off (loopback, RFC1918, unique local addresses, carrier-grade NAT)
            'blockPrivateRanges' => true,
            // Exact IPs allowed to bypass the private-range block only (never link-local/metadata)
            // Comma-separated string, i.e. '10.10.5.20, 10.10.5.21'
            'privateRangeAllowedIps' => null,
        ],
    ],
],
[...]

If you installed Passbolt with docker:

PASSBOLT_SECURITY_SSO_EGRESS_GUARD_ENABLED=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_ENABLED=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_LINK_LOCAL=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_PRIVATE_RANGES=true
PASSBOLT_SECURITY_SSO_EGRESS_PRIVATE_RANGE_ALLOWED_IPS="10.10.5.20, 10.10.5.21"

Performance and database-stored sessions (Beta)

Warning: this feature is still in beta and is not recommended for production use. If you do try it, we would be glad to hear your feedback. Keep in mind that enabling this feature can increase your server load, so consider it carefully before doing so.

Passbolt API can now store sessions in the database, improving performance by removing file-based session locking and simplifying high-availability deployments.

Administrators that want to test can enable the feature manually via configuration:

Update Session.defaults configuration in the passbolt.php file:

[...]
'Session' => [
        [...]
        'defaults' => 'database', // Set this to database
    ],
[...]

Or if you installed Passbolt with docker, set SESSION_DEFAULTS env var:

SESSION_DEFAULTS=database

Miscellaneous Improvements

Administrators are now notified whenever any user is deleted, giving them better visibility into account removals across the organisation. Previously, notifications were sent only when an administrator was deleted.

Conclusion

Many thanks to Luca Crippa for the security report on the JSON authentication token issue, Ashik Mohamed for the report on the SCIM administrator issue, and meifukun for the report on SSRF protection for SSO provider URLs, and to everyone who provided feedback, reported bugs, and contributed to making passbolt better!

Changelog

Check out the changelog to learn more about additional improvements and fixes.

Added

• PB-53238 Adds a healthcheck to warn users about PHP 8.2 end of life
• PB-53302 Adds a V5150CreateSessionsTable migration to support database session storage
• PB-53303 Adds a PurgeSessions command to prune expired database sessions
• PB-53547 Adds a V5150AddSessionsModifiedIndex migration to speed up session cleanup
• PB-53548 Adds a healthcheck entry reporting which session provider the application is using
• PB-53639 Adds a healthcheck warning admins the SSO egress guard is off and will default on in the next version
• PB-53885 Adds an allowDeleteAdministrators configuration to guard SCIM administrator deletion

Fixed

• PB-44325 Hides the "last logged in" timestamp for non-admins from the API
• PB-49590 Extends the admin-deletion email notification to also fire when a non-admin user is deleted
• PB-52221 HTML-escapes SMTP trace data in the webinstaller before rendering
• PB-52453 Closes personal-folder sharing bypass via blank metadata_key_type (Aikido#31150196)
• PB-52454 Blocks non-admin promotion of a V5 personal tag to shared via PUT /tags/{id} (Aikido#31150196)
• PB-52456 Blocks non-owner from unlinking shared V5 tags via POST /resources/{id}/tags (Aikido#31150196)
• PB-53146 Removes stack traces from missing-route exception responses
• PB-53180 Preserves historical permission levels in the activity log by no longer overwriting permissions_history on update
• PB-53260 Preserves resource tags and favorite information when one of a user's accesses is revoked but not all
• PB-53561 Rejects JWT tokens for disabled users
• PB-53563 Excludes sessions from the SQL dump command
• PB-53567 Rejects invisible characters in role names
• PB-53725 Fixes SessionPreventExtensionMiddleware creating a phantom session row for unauthenticated requests when SESSION_DEFAULTS=database
• PB-53815 Rejects invisible characters in group names, profile fields, resource names, folder names, and tag slugs

Security

• PB-53111 Makes single-use authentication-token consumption atomic to prevent concurrent replay
• PB-53210 Fixes security vulnerability advisories affecting the guzzlehttp/guzzle package (AIKIDO-2026-231561, GHSA-wm3w-8rrp-j577, AIKIDO-2026-793560, GHSA-94pj-82f3-465w)
• PB-53215 Fixes SSO Provider URL allowing private-network SSRF (MFK-01)
• PB-53223 Fixes stored XSS in the Account-Recovery Policy Update email (MFK-06)
• PB-53357 Upgrades js-yaml (GCVE-0-2026-59869)
• PB-53780 Upgrades squizlabs/php_codesniffer to 3.13.6 (CVE-2026-67434)
• PB-53952 Upgrades js-yaml (GHSA-5p4m-2wfm-xmqj)

Maintenance

• PB-51984 Removes remaining differences in the Webinstaller between CE and PRO repositories (MEP WP 7.2)
• PB-53119 Migrates SettingsIndexController logic into a dedicated Service layer
• PB-53270 Updates release version in file headers of the new user finders/tests (HLL)
• PB-53407 Upgrades CakePHP to v5.4.1
• PB-53453 Upgrades guzzlehttp/guzzle to 7.15.2
• PB-53655 Removes the config/schema/sessions.sql file
• PB-53874 Wires plugin table associations via Model.initialize instead of plugin bootstrap()
• Renovate: Update dependency phpstan/phpstan to v1.12.34
• Renovate: Update dependency duosecurity/duo_universal_php to v1.2.0
• Renovate: Update dependency cakephp/authentication to v3.3.7
• Renovate: Update dependency league/flysystem to v3.35.2
• Renovate: Update dependency league/oauth2-client to v2.9.0
• Renovate: Update dependency ramsey/uuid to v4.9.3
• Renovate: Update dependency spomky-labs/otphp to v11.5.0
• Renovate: Update dependency firebase/php-jwt to v7.1.0
• Renovate: Update adminer:standalone Docker digest