5.15 Security Bulletin
Passbolt 5.15 incorporates various security enhancements and hardening measures resulting from comprehensive internal assessments and external research.
These updates cover areas such as authentication policy enforcement, role-based access control, SCIM, browser extension security, and more. CVEs have been requested where appropriate and will be published once assigned.
We strongly advise all administrators to update to Passbolt 5.15 or newer to ensure the security of their instances.
Security Vulnerabilities
PB-53561 : Fix JWT token should not be usable for disabled user accounts (medium)
Product: Passbolt Pro API < 5.15
Problem: When an administrator disables a user, their already-issued JWT access token continues to grant full API access until the token expires (by default, 5 minutes).
Impact: A compromised or departing user could continue to access sensitive information temporarily even after an administrator attempted to revoke their access.
Solution: The system now validates account status for every request. If an account is disabled, access is rejected immediately, ensuring users with disabled accounts are effectively locked out.
CVE: Requested on 04/08/2026 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:H
Credit: Luca Crippa
PB-53885 : SCIM Administrator Accounts Can Be Deleted Through User Provisioning While the Equivalent (PATCH) Deactivation is Blocked (low)
Product: Passbolt Pro API < 5.15
Problem: A security safeguard designed to prevent the unauthorized removal of administrator accounts was not being consistently applied. Certain actions could bypass these protections, potentially allowing administrator accounts to be deleted in violation of organizational policies.
Impact: An unauthorized user with system access could potentially delete administrator accounts, ignoring established safety policies. This could lead to a loss of control over user permissions and administrative settings.
Solution: Passbolt now prevents automated user provisioning from deleting administrator accounts, matching the protection that already applied to deactivating them.
CVE: Requested on 28/08/2026 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Credit: Ashik Mohamed
Security Improvements
This section contain items that are classified as security improvements and hardening measures rather than directly exploitable vulnerabilities. In most cases, exploitation is theoretical, requires specific conditions outside Passbolt’s control, affects functionality not currently exposed by Passbolt clients, or relates to previously documented risks with mitigations already in place.
PB-53223 - Potential stored Cross Site Scripting (XSS) in Account-Recovery Policy Update Email (info)
Product: Passbolt Pro API < 5.15
Problem: Email notifications regarding account-recovery policy updates did not properly validate the content being sent. This created an opportunity for unauthorized code to be embedded within these messages.
Impact: If an administrator with malicious intent sent these specific notification emails, the embedded code could execute in the recipient's environment. This could potentially allow unauthorized access to sensitive information or the performance of unauthorized actions.
Solution: The email notification system has been updated to ensure all content is thoroughly validated and sanitized, preventing the inclusion of unauthorized code.
Credit: meifukun
PB-53386 : Potential Cross Site Scripting (XSS) via window.location.href (info)
Product: Passbolt Browser Extension < 5.15
Problem: The security check for website redirects was too broad, only checking the general website address rather than the specific page.
Impact: This could have allowed malicious actors able to control redirection URLs to redirect users to unauthorized or harmful web pages.
Solution: The system's redirection verification process has been strengthened to ensure all web page redirects are validated against approved destinations, preventing potential misuse.
Credit: Aikido Security
PB-52221 : Potential Cross Site Scripting (XSS) via SMTP trace data in webinstaller (info)
Product: Passbolt Pro API < 5.15
Problem: The installer template renders SMTP response messages directly into the HTML without escaping, leaving the application vulnerable to Cross-Site Scripting (XSS) if the SMTP server is malicious.
Impact: The flaw could potentially allow attackers to inject malicious code into the web page that executes within a victim's browser, leading to performance of unauthorized actions.
Solution: The installer has been updated to properly secure all system messages, ensuring that all input is validated and preventing the execution of unauthorized code.
Credit: Aikido Security
PB-44325 : Hide "last logged in" timestamp for non-admins from API (Info)
Product: Passbolt Pro API < 5.15
Problem: User activity metadata, specifically the "last logged in" timestamp, was visible to non-administrator users by design. For some organizations that is a privacy issue.
Impact: This exposed user activity patterns, allowing for potential tracking or profiling of users in a manner inconsistent with privacy expectations for large organizations.
Solution: The system now hides this information from non-administrator users across all relevant parts of the application, ensuring that activity timestamps remain private.
Credit: Passbolt customer support team.
PB-53215 : Additional SSRF protection for SSO provider URLs (Info)
Product: Passbolt Pro API < 5.15
Problem: An administrator can configure the SSO OAuth2/ADFS provider URL to a loopback, link-local, or private-network HTTPS address. This is a known issue previously reported by both Aikido and Cure53. It can be mitigated by disabling OIDC provider or PASSBOLT_SECURITY_SSO_SETTINGS_EDITION_DISABLED (prevent using such settings from the UI).
Impact: This vulnerability could allow unauthorized access to internal network services or data by directing the server to interact with restricted destinations.
Solution: additional mitigation has been implemented with extra egress guards and options.
Credit: meifukun
PB-53567 : Role names should not contain invisible characters (info)
Product: Passbolt Pro API < 5.15
Problem: The system allowed role names to contain invisible characters, such as special spacing or non-standard formatting. This enabled the creation of role names that visually mimicked restricted or existing roles.
Impact: This could lead to security inconsistencies, as it became possible to create "shadow" roles that appeared identical to protected ones but functioned differently, potentially bypassing intended security restrictions
Solution: Role name validation has been strengthened to reject invisible and non-standard characters, ensuring that all role names are unique, clearly identifiable, and cannot be spoofed.
Credit: Aikido Security
PB-53111 : Make single-use authentication-token consumption atomic to prevent concurrent replay (info)
Product: Passbolt Pro API < 5.15
Problem: The authentication process had a lapse where single-use security tokens could inadvertently be accepted more than once if multiple requests were sent at the exact same moment.
Impact: This could theoretically enable a malicious actor to potentially perform actions like repeating account setups or generating multiple sessions.
Solution: The system now enforces strict processing for security tokens, ensuring that each token is valid for one use only and preventing any duplicate processing attempts even when requests are simultaneous.
Credit: Passbolt Development Team.
PB-52453 : Close personal-folder sharing bypass via blank metadata_key_type (info)
Product: Passbolt Pro API < 5.15
Problem: The system allowed folder owners to bypass privacy protections on their personal folders by using specific configuration settings. Due to this, users could cause the system to ignore privacy restrictions, potentially making folders that should have remained private accessible to others.
Impact: Theoretically, this could allow a user to share an encrypted personal folder that should remain private, potentially exposing it to other users or groups. However, no Passbolt client currently supports encrypted folders, so there is no known practical way to exploit this issue with the currently available clients.
Solution: Security validation rules are strengthened to ensure private folders remain private, enforcing strict privacy settings and preventing them from being shared.
Credit: Aikido Security
PB-52454 : Block non-admin promotion of V5 personal tag to shared via PUT /tags/{id} (info)
Product: Passbolt Pro API < 5.15
Problem: The system allowed users to promote their personal tags to a "shared" status. This bypassed intended security controls designed to restrict the creation of shared tags.
Impact: Theoretically, this could allow non-admin users to make personal tags shared, potentially causing unwanted tags to become visible to other users. However, no Passbolt client currently supports V5 tags, so there is no known practical way to exploit this issue using the currently available clients.
Solution: The system is updated to strictly prohibit users from promoting personal tags to "shared". Validation rules are now in place to ensure that shared tags can only be managed by authorized personnel.
Credit: Aikido Security
PB-52456 : Block non-owner from unlinking shared V5 tags via POST /resources/{id}/tags (info)
Product: Passbolt Pro API < 5.15
Problem: The system did not properly verify user permissions when removing shared tags from resources. This allowed users who were not the owners of a shared resource to remove these tags, even if they did not have the authority to manage them.
Impact: Theoretically, as shared tags are visible to everyone, removing one could unintentionally strip that tag for every user sharing the resource. This could disrupt how teams organize and view their shared information. However, no Passbolt client currently supports V5 tags, so there is no known practical way to exploit this issue using the currently available clients.
Solution: The system now verifies that a user has appropriate permissions before allowing the modification or removal of shared tags and unauthorized attempts to unlink shared tags are rejected.
Credit: Aikido Security
