Passbolt 5.18.0 "Superstylin" introduces custom themes to personalize your workspace, expands Quick Access support to Secure Notes and Custom Fields, and enhances autofill reliability. This release also drives performance improvements on sharing operations, updates dependencies, and brings in essential security fixes.
Themes
The 5.18 release adds two new custom theme options, Sakura and Layette, providing enhanced personalization for the user's workspace appearance.
These themes allow users to adapt the interface to their personal preferences while maintaining consistent user experience throughout the application.
If you have an idea for a new theme let us know on the Community Forum.
More resource types in Quick Access
Passbolt 5.18 expands Quick Access support to Secure Notes and Custom Fields, allowing users to access all their resources directly from Quick Access. Users can quickly search, preview, and copy these resources without opening the full Passbolt application.
Both resource types seamlessly integrate with Offline Mode, ensuring they remain accessible even when disconnected from the server. Additionally, Quick Access automatically suggests relevant Notes and Custom fields for a website if the URL matches.
Additional Improvements
This release brings autofill improvements to enhance reliability on high-resolution displays and refines recognition logic on login forms to ensure smooth auto-filling. Also, large sharing operations are now more than twice as fast, speeding up access updates when sharing 200 or more resources at once.
Maintenance and Security
Passbolt 5.18 strengthens the Duo second factor. Duo now confirms that the account completing it belongs to the user signing in, so a compromised first factor can no longer be paired with a different Duo account. The check is on by default when enabling Duo for the organization for the first time. On existing ones it stays off until an administrator enables it, so align each user's Duo identifier with their Passbolt email first to avoid locking anyone out.
A detailed security bulletin will follow with more information about the security issues addressed in this release. In addition, routine dependency upgrades have been completed to keep the application fast and secure.
Conclusion
Many thanks to everyone who provided feedback, reported bugs and contributed to making Passbolt better.
Changelog
Added
- PB-54386 As an administrator I can see every healthcheck in the administration panel through the generic healthcheck API
- PB-54757 As an administrator I can exclude healthchecks by key or domain from the healthcheck API
- PB-52437 As an administrator I can enforce Duo subscriber verification from the MFA settings
- PB-55621 Adds a healthcheck warning administrators when Duo is enabled without subscriber verification
- PB-55530 As a user I can choose the Sakura and Layette themes
- PB-56051 As an administrator I can set a maximum number of users, groups and resources records in the database
Fixed
- PB-54825 Renames the healthcheck domains to dash case and replaces the per-domain CLI options with --filter
- PB-55619 Enforces the Duo subscriber verification on Duo setup and login
- PB-55383 Retries group updates on database deadlock and returns a 409 when the lock persists
- PB-55475 Returns a 404 instead of a 500 on JSON requests to HTML-only pages
- PB-55613 Speeds up resources and folders index queries by joining on the user's accessible ids
- PB-55776 Fixes SCIM user provisioning failing with a 500 when externalId or userName contains non-ASCII characters
- PB-55783 Requires a JSON request on the current SSO settings endpoint
Security
- PB-54749 Rejects private key material and multiple armored blocks when parsing public keys (AV-01)
- PB-54972 Fixes V5 resource share bypass with a blank metadata_key_type (SS-01)
- PB-55798 Prevents HTTP method override to stop bypass of method-based proxy rules (FM-02)
- PB-32905 Rejects secrets that are not encrypted for their recipient
- PB-55900 Fixes i18next-http-backend multiple CVEs (CVSS3.1 LOW)
- PB-55657 Upgrades composer/ca-bundle to 1.6.0 (AIKIDO-2026-256661)
- PB-55408 Upgrades spomky-labs/cbor-php to 3.3.5
- PB-55409 Upgrades web-auth/cose-lib to 4.7.2
- PB-56131 Upgrades symfony packages to fix composer audit vulnerability advisories
- PB-54930 Enables strict integrity validation in package-lock.json lint checks
- PB-54931 Enables package name validation in package-lock.json lint checks
Maintenance
- PB-54542 Fixes tests not behaving well with the in-memory GPG backend changes
- PB-55968 Cleans up deprecated npm packages and package.json overrides
- PB-56100 Bumps the styleguide to v5.18.0
- PB-55255 Extends the insert dummy data command to populate LDAP settings in the organization settings
- PB-56150 Fixes the PHP version and environment variables in DDEV cron jobs
- Renovate: Update dependency cakephp/cakephp to v5.4.3
- Renovate: Update dependency cakephp/plugin-installer to v2.0.3
- Renovate: Update dependency firebase/php-jwt to v7.2.1
- Renovate: Update dependency ramsey/uuid to v4.9.4
- Renovate: Update dependency web-auth/webauthn-lib to v5.3.9
- Renovate: Update adminer:standalone Docker digest