5.14 Security Bulletin
Passbolt 5.14 includes a number of security fixes and hardening improvements identified through internal review, external security research, and our ongoing collaboration with Aikido Security.
The issues addressed range from MFA policy enforcement and RBAC integrity to browser extension hardening, access control, and token handling. No exploitation of these issues has been reported to us. Where applicable, CVEs have been requested and will be added to this bulletin once assigned.
We recommend that administrators upgrade to Passbolt 5.14 or later to benefit from these fixes.
PB-52440 : Disabled TOTP provider can still mint an MFA verification cookie via non-JSON /mfa/verify/totp (medium)
Product: Passbolt Pro API < 5.14
Problem: When TOTP was disabled by an administrator, users with an existing TOTP configuration could still use that provider to complete MFA under certain conditions. The provider policy was therefore not consistently enforced across all verification flows.
Impact: An already authenticated user with TOTP previously configured could use the disabled provider to satisfy the MFA requirement. This could bypass the administrator’s intended MFA provider policy, although it does not bypass the initial authentication step.
Solution: TOTP verification now consistently enforces the current provider policy. A disabled TOTP provider can no longer be used to complete MFA.
CVE: Requested on 2026-08-12 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:H
Credit: Aikido Security
PB-52457 : Block rename of reserved roles to close delete-protection bypass (medium)
Product: Passbolt Pro API < 5.14
Problem: Built-in roles such as admin, user, guest and root were protected against deletion, but the same protection was not applied to renaming. An administrator could therefore rename a reserved role and subsequently delete it.
Impact: An administrator could put the instance into an invalid state by modifying built-in roles. In particular, renaming or removing the admin role could cause existing administrators to no longer be recognized as administrators and potentially make the instance unusable. This requires existing administrator privileges and is not a privilege-escalation issue.
Solution: Built-in roles are now protected against renaming as well as deletion, preserving the integrity of the required system roles.
CVE: Requested on 2026-08-12 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:H
Credit: Aikido Security
PB-29515 : MFA remember me policy bypass (low)
Product: Passbolt Pro API < 5.14
Problem: The administrator setting controlling whether users may remember an MFA-verified device was not consistently enforced. A user could retain a trusted-device state even after the administrator had disabled this capability.
Impact: An authenticated user could continue benefiting from a remembered MFA session and avoid MFA prompts on subsequent logins despite the administrator’s policy. The issue affects enforcement of the MFA configuration rather than allowing an unauthenticated attacker to bypass MFA.
Solution: The remember-device policy is now consistently enforced for both new and existing MFA sessions. Trusted-device states that are no longer permitted by policy are no longer accepted.
CVE: Requested on 2026-08-12 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:H
Credit: Damir
PB-49150 : Potential Cross Site Scripting (XSS) via window.location.href - passbolt-styleguide (info)
Product: Passbolt Browser Extension < 5.14
Problem: The browser extension did not sufficiently restrict some client-side SSO redirection destinations. Under certain conditions, a user-controlled destination could therefore be used instead of the expected trusted origin.
Impact: An attacker able to influence the redirect destination could cause a user to be redirected to a malicious website after an SSO flow. This could be used as part of a phishing or credential-theft scenario, but does not by itself provide access to Passbolt data.
Solution: SSO redirections are now validated and restricted to trusted destinations associated with the expected origin.
CVE: N/A
Credit: Aikido Security
PB-52333 : Improper Access Control in portManager (info)
Product: Passbolt Browser Extension < 5.14
Problem: The QuickAccess interface could be rendered inside an iframe controlled by another website, making it potentially vulnerable to clickjacking.
Impact: A malicious website could embed the QuickAccess interface and attempt to trick a user into interacting with it without fully understanding what they are clicking. Successful exploitation would require user interaction and could potentially cause unintended actions within QuickAccess.
Solution: QuickAccess is now restricted to appropriate top-level browser contexts and can no longer operate when embedded inside an iframe.
CVE: N/A
Credit: Aikido Security
PB-52334 : Improper Input Validation in resourcesKdbxExporter (info)
Product: Passbolt Browser Extension < 5.14
Problem: Custom field names were not checked for conflicts with field names reserved by the KDBX format. A custom field could therefore overwrite or interfere with structural information during an export.
Impact: A conflicting field name could produce malformed or incompatible KDBX exports and potentially result in loss or corruption of information in the exported file. The issue affects export integrity and does not provide an attacker with additional access to Passbolt.
Solution: KDBX exports now detect and resolve conflicts between custom field names and reserved KDBX fields, preserving both custom data and the required export structure.
CVE: N/A
Credit: Aikido Security
PB-52461 : Fix last-resource-type guard counting soft-deleted rows (info)
Product: Passbolt API < 5.14
Problem: The check preventing deletion of the last available resource type incorrectly counted resource types that had already been deleted. As a result, the final active resource type could still be removed.
Impact: An administrator could leave an instance without any active resource type, preventing users from creating new resources. The realistic risk is primarily accidental administrative misconfiguration rather than exploitation by an unprivileged attacker.
Solution: Resource-type deletion checks now consider only active resource types and prevent administrators from removing the last one.
CVE: N/A
Credit: Aikido Security
PB-52452 : Harden secret revocation on share (info)
Product: Passbolt API < 5.14
Problem: Secret access after a sharing change depended on revoked secret data being correctly cleaned up. There was no independent access check protecting against stale secret data if that cleanup did not occur as expected.
Impact: If cleanup failed during a resource sharing change, a user who had previously been authorized but had since lost access could potentially continue retrieving stale secret data. Exploitation requires a specific sharing and cleanup failure condition.
Solution: Secret revocation and authorization checks have been strengthened so that users who no longer have permission to a resource cannot retrieve stale secret data, even if cleanup does not occur as expected.
CVE: N/A
Credit: Aikido Security
PB-52441 : Refresh-token rotation can be replayed concurrently because consumption is non-atomic (info)
Product: Passbolt API < 5.14
Problem: Refresh tokens are intended to be consumed once during rotation, but concurrent requests could cause the same token to be accepted more than once.
Impact: An attacker who had already obtained a valid victim refresh token could attempt to reuse it concurrently before it was invalidated. This could weaken refresh-token rotation and potentially allow unauthorized access to persist for longer. The issue does not provide a way to obtain the original refresh token.
Solution: Refresh-token consumption is now enforced as a single-use operation even when multiple requests are made concurrently. Once one request consumes the token, subsequent attempts are rejected.
CVE: N/A
Credit: Aikido Security
PB-52463 : Gate filter[is-deleted] on resource-types index to admins only (info)
Product: Passbolt API < 5.14
Problem: Authenticated non-admin users could request information about resource types that had been deleted, despite this information being intended for administrative use.
Impact: An authenticated user could enumerate metadata associated with deleted resource types, including their names, descriptions and definitions. This is limited to resource-type metadata and does not expose resources, passwords or secrets.
Solution: Access to deleted resource-type information is now restricted to administrators, while regular users only receive information about active resource types.
CVE: N/A
Credit: Aikido Security
