passbolt_api

Song: https://www.youtube.com/watch?v=gI6fQ2IXMjE

Passbolt 5.16.0 introduces Offline Mode, allowing users to access their credentials when the Passbolt server is unreachable.

Offline mode (Beta)

During server maintenance, data center interventions, or network outages, teams lose access to critical credentials needed to restore systems, if those credentials are locked inside an unreachable Passbolt server.

Offline mode closes this availability gap by providing secure read-only access to essential credentials when the server is unreachable. This ensures business continuity, satisfies compliance mandates for disaster recovery, and eliminates the need for insecure, stale manual exports.

The administrator enables Offline Mode in the administration settings and can use Role-Based Access Control (RBAC) to refine which roles have access.

Individual users allowed to access the capability can then select and mark specific resources within the application to make them available offline. Once marked for offline use, credentials can be accessed directly via the QuickAccess menu in the Passbolt browser toolbar.

Offline storage is limited to a maximum of 1,000 resources per user. The feature currently supports only password and TOTP resource types with encrypted metadata. Upcoming releases will add support for other resource types and the ability to mark resources offline in bulk.

Security Considerations

Offline resources are accessible for 5 minutes per session by default and encrypted information persists in browser storage for up to 7 days without server connectivity. Passbolt Pro allows administrators to adjust both session durations and data retention limits to align with organisational compliance requirements.

Once synchronised, credentials marked for offline access are cached on every browser connected to the same Passbolt account making them available across all devices.

Beta Testing

Because Offline Mode is in Beta and will be undergoing a third-party security review, it should be used for testing purposes only. A follow-up blog post covering its mechanics, limitations, and additional security considerations will be published soon.

We welcome your feedback if you test it on a non-production instance.

Maintenance and security

As usual, this release ships a round of third-party dependency upgrades and security advisory fixes, with no user-visible impact. It also addresses minor bugs reported by the community. Check out the changelog for more information.

Conclusion

Many thanks to everyone who provided feedback, reported bugs, and contributed to making Passbolt better!

Changelog

Added

• PB-52633 Add support for Offline Mode

Fixed

• PB-54100 Fix account recovery notifications are sent to deleted admins
• PB-54504 Fix MissingTemplateException on .json endpoints when X-Requested-With: XMLHttpRequest is set
• PB-54574 Fix lock-wait-timeout on DELETE during group edit that removes a user

Security

• PB-54489 Upgrade phpseclib/phpseclib to 3.0.57 (CVE-2026-84308, AIKIDO-2026-730961)
• PB-54532 Small upgrade for js-yaml

Maintenance

• PB-49136 Update cakephp/migrations package to improve compatibility with PHP 8.5
• PB-53658 Use Request to DTO Mapping to automatic mapping of request data
• PB-53925 Add tests to assert session data do not trigger any code
• PB-54144 Update the Passbolt logo
• Renovate: Update adminer:standalone Docker digest
• Renovate: Update dependency cakephp/cakephp to v5.4.2
• Renovate: Update dependency composer/composer to v2.10.3
• Renovate: Update dependency league/flysystem to v3.35.3

Song: https://youtu.be/SLNqxQXMV1w?si=M3l6Zz4GffohF-OZ

Passbolt 5.15.0 improves form detection for autofill, makes permission changes easier to review, and adds several security and administration improvements. This release also introduces new session management tooling and additional safeguards for Passbolt Pro.

Clearer permission confirmation changes

Permission changes are now easier to understand before they take effect, helping users avoid accidental access changes. New badges clearly show whether a permission is being added, modified, or deleted, so users can see exactly what will change at a glance.

Deleted permissions can also be rolled back to their original state before confirmation, making access changes easier to review and adjust.

Improved autofill detection

Autofill now works more reliably on modern websites that were previously unsupported. Improved form detection helps users fill credentials more consistently and with less manual effort, resulting in a smoother autofill experience.

This is the first step in a broader series of autofill improvements, with upcoming releases focused on reducing false positives and further refining form classification. A technical blog article explaining those improvements in detail will be published after the next release.

Security

Invalidate JSON authentication token for disabled users

Disabling a user now cuts off their access straight away when they are signed in with JWT authentication, as was already the case for other authentication methods. Previously, a user who had just been disabled could keep using the API for up to 5 minutes. Only the mobile application and power users with a custom API integration were affected.

Last login dates only available for administrators

Privacy has also been strengthened by restricting users' last login dates to administrators only, reducing unnecessary exposure of sensitive account activity.

SCIM administrators protected against deletion (Pro Edition)

SCIM providers can no longer delete Passbolt administrators by default, helping prevent an identity provider from accidentally locking an administrator out.

Organisations that intentionally manage administrator removal through SCIM can disable this protection by updating their configuration.

If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:

[...]
// plugins configuration.
'plugins' => [
    'scim' => [
        'security' => [
            'allowDeleteAdministrators' => true
        ]
    ],
],
[...]

If you installed Passbolt with docker, you can use the following environment variable:

PASSBOLT_PLUGINS_SCIM_SECURITY_ALLOW_DELETE_ADMINISTRATORS=true

SSRF protection for SSO provider URLs (Pro Edition)

SSO provider integration is now blocked from accessing internal or private network addresses, reducing the risk of malicious or misconfigured redirects. A new healthcheck flags when the protection is disabled. It remains off by default for backward compatibility and will become the default in a future release.

Organizations that would want to enforce it could already do it by configuration.

If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:

[...]
'security' => [
    'sso' => [
        'egress' => [
            // Master switch for the SSRF guard
            'enabled' => true,
            // Enforce vs. warn-only
            // true blocks the connection
            // false logs a warning but still connects
            'block' => true,
            // Turn the always-blocked category on/off (link-local + cloud metadata)
            'blockLinkLocal' => true,
            // Turn the private-range category on/off (loopback, RFC1918, unique local addresses, carrier-grade NAT)
            'blockPrivateRanges' => true,
            

Song: https://youtu.be/pIqrmGKfmQU

Passbolt 5.14.3 addresses issues identified after the 5.14 release.

Following the introduction of the permission confirmation dialog in 5.14, two behaviors needed correction. The dialog appeared when editing only the metadata of a shared resource, such as renaming it, even though no secret was changed. It now appears only when the secret is modified. Additionally, when creating a resource in a shared folder where the user is not the owner, the dialog allowed editing the permissions inherited from the parent folder, potentially overriding the access structure established by the organization. The dialog now opens in read-only mode in this situation, allowing the user to review permissions and group members before proceeding without overriding the permissions. Users authorized to manage access can still update permissions directly.

Additionally, the in-form menu could appear even when disabled on the API by feature flag. The API could in some cases return plugin configuration in an unexpected format, and the browser extension would fall back to enabling any plugin whose setting did not strictly match. Both the API and the browser extension now enforce a strict format, and the in-form menu correctly reflects the settings.

Finally, a separate regression prevented the API from running over HTTP. While this is not recommended, the regression could break testing or staging instances not using HTTPS.

Many thanks to everyone who reported these issues.

Changelogs

Fixed

• PB-53457 Fix env()-backed config flags to enforce strict boolean type
• PB-53498 Fix CSRF cookie not working over HTTP deployments

Song: https://youtu.be/JfP3sB-hke4

Passbolt 5.14.0 Sunshine introduces explicit permission confirmation prompts to improve control over shared resources. This release also addresses a security issue related to MFA policy enforcement and includes usability improvements.

Sharing transparency

Users now receive an explicit confirmation dialog before creating items in shared folders or editing shared resources. This provides full permission transparency before changes take effect, preventing accidental privilege exposure.

In addition, when a group appeared in the access list, its individual members were not visible, making it difficult to assess the actual reach of shared access. Group members are now displayed directly within the dialog.

As the first stage of a broader security initiative, future updates will extend these confirmations to folder move operations and offer enhanced permission preview dialogs.

Edition and Subscription Management

The Passbolt edition is now visible in the application footer, and Terms & Credits links have moved to the main navigation menu.

Additionally, whenever administrators downgrade to the Community edition they will be explained the impact on data and feature beforehand so they can make an informed decision.

Resource Suggestions

Suggested resources in the browser extension are now ranked using an improved URL relevance algorithm. Exact URL matches appear first, followed by parent paths and domain matches, allowing users to select the correct credentials faster and with fewer autofill errors.

Security Improvements

This release addresses a low-severity vulnerability that allowed a user with a valid account and MFA access to remember their device for a month even when the organisation had disabled that option. Reported by security researcher Damir, the issue affected Passbolt API versions up to 5.13.0 and is now enforced correctly at the API level in 5.14.0.

Additional Improvements

Passbolt Pro extends email-free account setup and recovery to OIDC and ADFS SSO providers, improving onboarding by integrating directly with enterprise identity management systems.

Finally, this release lays the foundational backend architecture required for upcoming offline functionality.

Conclusion

Many thanks to Damir and everyone who provided feedback, reported bugs, and contributed to making Passbolt better!

Changelogs

Added

• PB-49943 Add a model cache health check service
• PB-50621 Add recover flow support for OAuth2 & ADFS SSO providers
• PB-52153 Add a command to insert dummy data into the email_queue table
• PB-52421 Add more verbose logs when an SSO provider response is in an incorrect format

Fixed

• PB-48004 Fix deprecation warnings in makeCsrfCookieSecureIfRequestIsSsl
• PB-52585 Fix resource sharing after inserting dummy data
• PB-52727 Fix typo in SSO settings activated email
• PB-52952 Return 400 instead of 409 when the email is not found in the expected place from a SCIM IdP
• PB-52592 Fix account recovery response email not being sent to custom RBAC roles

Security

• PB-29515 Fix MFA remember me policy bypass (INC-2046)
• PB-32421 Validate and filter user-edit request data via a modeless form instead of UsersEditController::_validateRequestData
• PB-51819 Upgrade composer/composer (AIKIDO-2026-688935)
• PB-52440 Fix a disabled TOTP provider still being able to mint an MFA verification cookie via non-JSON /mfa/verify/totp
• PB-52441 Fix refresh-token rotation being replayable concurrently due to non-atomic consumption
• PB-52452 Harden secret revocation on share
• PB-52457 Block renaming of reserved roles to close a delete-protection bypass
• PB-52461 Fix last-resource-type guard incorrectly counting soft-deleted rows
• PB-52463 Restrict filter[is-deleted] on the resource-types index to admins only
• PB-52538 Upgrade js-yaml
• PB-52599 Upgrade spomky-labs/otphp (GHSA-g7m4-839x-ch6v, GHSA-2jx3-