Releases »

11.1 »

11.1.13

Cerb (11.1.13) is a maintenance update released on October 30, 2026. It includes 12 security fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Security

  • [Security/SSO] Fixed an open redirect in the post-login flow. After signing in, workers are now only redirected to URLs on this Cerb instance.

  • [Security/Support Center] Fixed Support Center requesters being able to remove other participants from a shared ticket. Requesters may now only remove their own addresses, and can no longer add participants from the portal. Thanks to kta1kri for the report!

  • [Security/Records] Fixed missing authorization checks when adding or removing record links, viewing link counts and linked records, and toggling yourself as a watcher. Workers now need edit access to the source record and read access to linked records. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Watchers] Fixed the watchers popup showing a record's label and watchers to workers without read access to the record. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API ticket merge endpoint not enforcing write access to every merged ticket or the merge privilege. Thanks to kta1kri for the report!

  • [Security/Support Center] Fixed the contact form adding Cc: participants to an existing ticket when the subject contained its mask, and accepting a subject or Cc: recipients when those fields are disabled. Thanks to kta1kri for the report!

  • [Security/Automations] Fixed the built-in ticket interactions for assigning, moving, and adding/removing participants not checking that the current worker can modify the ticket. Thanks to kta1kri for the report!

  • [Security/Records] Fixed editing a record through its editor not checking that the worker can modify the existing record, only its new owner. This affected worklists, custom fields, snippets, email signatures, calendars, saved searches, custom fieldsets, project boards, custom records, and workspace widgets. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/SSO] Fixed OpenID Connect sign-in not rejecting disabled workers. Login completion now rejects disabled workers for every authentication method. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API's link and unlink endpoints only requiring read access. Workers now need edit access to the 'on' record and read access to each target, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Records] Linking a custom fieldset now requires edit access to the records it is added to. Moving a project board card now requires edit access to both columns and read access to the card.

  • [Security/Notifications] Fixed workers being able to read other workers' notifications through the REST API and record searches. Notifications are now readable only by their owner and admins. Thanks to Muhammad Harley for the report!