Passbolt Windows 2.12.0: Permission Confirmations, Duo MFA & Security Improvements

Introduction

Passbolt Windows 2.12.0 introduces explicit permission confirmation prompts to improve control over shared resources. This release also addresses a security issue related to MFA policy enforcement and includes usability improvements and adds DUO authentication support for MFA providers.

Users now receive an explicit confirmation dialog before creating items in shared folders or editing shared resources. This provides full permission transparency before changes take effect, preventing accidental privilege exposure.
In addition, group members are now displayed directly in the dialog, giving users a clearer view of who has access before confirming the change.

DUO authentication

The Windows app is now supporting the Duo authorization, which was a limitation on the previous versions.

Edition and Subscription Management

The Passbolt edition is now visible in the application footer, and Terms & Credits links have moved to the main navigation menu.

Resource Suggestions

Suggested resources in the browser extension are now ranked using an improved URL relevance algorithm. Exact URL matches appear first, followed by parent paths and domain matches, allowing users to select the correct credentials faster and with fewer autofill errors.

Security Improvements

This release addresses a low-severity vulnerability that allowed a user with a valid account and MFA access to remember their device for a month even when the organisation had disabled that option. Reported by security researcher Damir, the issue affected Passbolt API versions up to 5.13.0 and is now enforced correctly at the API level in 5.14.0.

Changelog

Added

PB-52894 - WINDUO - Add DUO to the navigation urls authorization list
PB-52895 - WINDUO - Remove IPC settings whenever a webview leave the virtual host
PB-52896 - WINDUO - Update WebMessageReceived to allcommunication
PB-52897 - WINDUO - Update WebResourceRequested to filter rendered and background to the strict mode
PB-52901 - WINDUO - Add frame navigation allow with
PB-45405 - Sort suggested resources by relevance instead of URI lengths
PB-51236 - OFM - WP2.3 Create SiteSettingsLocalStorage
PB-51476 - Add support for ADFS and OIDC on the account recovery with SSO workflow
PB-51810 - PCD 2.29 - Create GroupPermissionItem
PB-51811 - PCD 2.30 - Remove SharePermissionItem
PB-51813 - PCD 2.32 - Update CreateResource to call the workflow handler
PB-51814 - PCD 2.33 - Create PermissionServiceWorkerService
PB-51826 - PCD 3.01 - Update EditResource to call the workflow handler
PB-51828 - PCD 3.03 - Add edition handling in HandlePermissionWorkflow
PB-51829 - PCD 3.04 - Update resourceUpdateService to get permissions list from the styleguide
PB-51830 - PCD 3.05 - Update EditResource to display dialog
PB-51831 - PCD 3.06 - Update DisplayResourcesListContextualMenu to trigger HandlePermissionWorkflow
PB-51832 - PCD 3.07 - Update DisplayResourcesWorkspaceMenu to trigger HandlePermissionWorkflow
PB-51833 - PCD 3.08 - Handle read-only mode in permission dialog
PB-51835 - PCD 4.01 - Add share handling in HandlePermissionWorkflow
PB-51836 - PCD 4.02 - Adapt PermissionServiceWorkerService (savePermissions)
PB-51838 - PCD 4.04 - Update DisplayResourcesListContextualMenu to trigger HandlePermissionWorkflow from sharing
PB-51839 - PCD 4.05 - Update DisplayResourcesWorkspaceMenu to trigger HandlePermissionWorkflow from sharing
PB-52205 - OFM - WP1.4 Create SiteSettingsEntity
PB-52213 - OFM - WP3.4 Create SiteSettingsApiService
PB-52215 - OFM - WP4.18 Create GetOrFindSiteSettingsService
PB-52216 - OFM - WP4.19 Create FindSiteSettingsService
PB-52217 - OFM - WP4.20 findAndUpdateSiteSettingsLocalStorageService
PB-52350 - LS - WP1.1 Create local storage online session entity
PB-52352 - LS - WP1.2 Create local storage metadata entity
PB-52354 - LS - WP2.1 Create online session local storage
PB-52363 - LS - WP2.2 Create abstract local storage
PB-52374 - LS - WP2.3 Migrate Rbac local storage
PB-52375 - LS - WP2.4 Migrate Resource types local storage
PB-52411 - LS - WP2.5 Migrate UserMe local storage
PB-52412 - LS - WP2.6 Remove AuthStatus local storage to use ActiveSession local storage
PB-52447 - LS - WP3.1 Update GetOrFindRbacService
PB-52451 - LS - WP3.2 Create GetOrFindMeService and remove userModel getOrFindMe
PB-52460 - LS - WP 3.3 Create GetOrFindResourceTypes and remove resourceTypeModel getOrFindAll
PB-52713 - SORTURL - WP 1.1 - Implement url sorting algorithm in sortUtils
PB-52714 - SORTURL - WP 1.2 - Use sortUtils in HomePage
PB-52715 - SORTURL - WP 1.3 - Use sortUtils in InformMenuController
PB-52965 - HLL - WP 4.1 Hide the last logged in column for non admins
PB-52977 - PCD 6.26 - Fix group member count display on newly added group
PB-53028 - PCD 6.27 - Adapt Permission confirmation dialog title based on the ran process
PB-52536 - Display passbolt edition in right sidebar footer
PB-53542 - Windows application align with 5.14 release

Fixed

PB-50607 - Inject In-form menu CTA container inside Dialog element
PB-50876 - Secret history doesn't take in consideration RBAC cfg
PB-51920 - Multiple autofill issues
PB-52683 - Fix missing translation in healthcheck page
PB-52799 - In-Form menu CTA not visible anymore
PB-52357 - Mark "OpenId Configuration Path" as a required field in SSO
PB-52938 - Fix the subscriptionKey button not appearing when API is below than 5.13
PB-53406 - PCD: do not display when editing a shared resource metadata only
PB-53417 - PCD: creation of a shared resource in a non owned folder should display the PCD in read-only
PB-53546 - SiteSettings: Fix passbolt.plugins.inFormIntegration.enabled type from string to boolean

Maintenance

PB-50075 - Remove DisplayUserDetailsActivity
PB-51917 - Remove getOrFindAll from UserModel
PB-52199 - Remove formatOrderOptions reference in API services as it is not in use
PB-52298 - Cover admin edition management journeys with end to end tests
PB-52467 - Pin js dependencies in lockfile
PB-52606 - Assert Subscription Details
PB-52607 - Assert Current Subscription Edition
PB-52609 - Upgrade to Pro
PB-52612 - Downgrade to CE
PB-52613 - Edit the organization subscription key in adminer
PB-52614 - Notify user of successful downgrade, Expire User's Session and Re-authenticate the user
PB-52615 - Assert Subscription Panel
PB-52691 - Retry In-form menu CTA injection when DOM changes are detected
PB-52711 - Create new subscription key using rsa public/private keys to avoid exposing production valid subscription key
PB-52542 - Update subscription page design
PB-52584 - Downgrade to CE design

Security

PB-49150 - Aikido#915877 Potential Cross Site Scripting (XSS) via window.location.href - passbolt-styleguide (info)
PB-51261 - Major upgrade for i18next (High)
PB-52333 - Improper Access Control in portManager (Info)
PB-52334 - Improper Input Validation in resourcesKdbxExporter (Medium)
PB-52485 - Fix esbuild GHSA-gv7w-rqvm-qjhr - HIGH CVSS3.1
PB-52538 - Major upgrade for js-yaml (Medium)
PB-52554 - Fix ws GHSA-96hv-2xvq-fx4p - HIGH CVSS 3.1
PB-52555 - Fix launch-editor GHSA-v6wh-96g9-6wx3 - MEDIUM CVSS4.0
PB-52556 - Fix tmp GHSA-7c78-jf6q-g5cm - HIGH CVSS3.1
PB-52557 - Fix form-data GHSA-hmw2-7cc7-3qxx - HIGH CVSS4.0
PB-52558 - Fix @babel/core GHSA-4x5r-pxfx-6jf8 - LOW CVSS3.1
PB-52601 - Fix undici GHSA-vmh5-mc38-953g - HIGH CVSS3.1
PB-52602 - Fix http-proxy-middleware GHSA-64mm-vxmg-q3vj - MEDIUM CVSS4.0
PB-52603 - Fix webpack-dev-server GHSA-mx8g-39q3-5c79 - MEDIUM CVSS3.1
PB-52611 - Small upgrade for serialize-javascript (High)
PB-52621 - Fix undici GHSA-g8m3-5g58-fq7m - HIGH CVSS 3.1
PB-52719 - Potential Cross Site Scripting (XSS) via window.location.href (Medium)
PB-52337 - Minor upgrade for enhanced-resolve (Medium)
PB-52444 - Fix lodash and lodash-es GHSA-f23m-r3pf-42rh
PB-52444 - Fix minimatch GHSA-23c5-xmqv-rm74
PB-52444 - Fix svgo GHSA-xpqw-6gx7-v673
PB-52444 - Fix @tootallnate/once GHSA-vpq2-c234-7xj6
PB-52444 - Fix @xmldom/xmldom GHSA-j759-j44w-7fr8
PB-52538 - Major upgrade for js-yaml (Medium)
PB-52554 - Fix ws GHSA-96hv-2xvq-fx4p - HIGH CVSS 3.1
PB-52557 - Fix form-data GHSA-hmw2-7cc7-3qxx - HIGH CVSS4.0
PB-52558 - Fix @babel/core GHSA-4x5r-pxfx-6jf8 - LOW CVSS3.1
PB-52611 - Small upgrade for serialize-javascript (High)
PB-52885 - Major upgrade for i18next (High)
PB-53357 - Fix js-yaml GCVE-0-2026-59869 - HIGH CVSS 3.1
PB-53358 - Fix brace-expansion GHSA-3jxr-9vmj-r5cp -
PB-53391 - Fix svgo GHSA-2p49-hgcm-8545 - HIGH CVSS3.1
PB-53392 - Fix fast-uri GHSA-4c8g-83qw-93j6 - HIGH C
PB-53550 - Small upgrade for js-yaml (Low)
PB-53552 - Fix fast-uri GHSA-7p8r-x3mc-p8w7 - HIGH CVSS3.1
PB-53559 - Fix brace-expansion GHSA-mh99-v99m-4gvg -