Releases »

11.1 »

11.1.14

Cerb (11.1.14) is a maintenance update released on November 05, 2026. It includes 30 minor fixes and security patches from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Changed

  • [Calendars] Calendars are now readable by all workers, matching how worklists and availability widgets already shared them. Previously, a worker-owned calendar's profile page was only viewable by its owner. Editing and deleting calendars still requires ownership.

  • [Mail/HTML Templates] HTML email templates are now readable by all workers, matching how the reply, compose, and broadcast template pickers already shared them. Editing and deleting templates still requires ownership.

Security

  • [Security/Login] Account recovery now fails closed when a secret question is missing its question or answer. Saving a secret question now requires both a question and an answer. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] The REST API's attachment download endpoint now requires the worker's 'download attachments' privilege, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Interactions] The file download prompt in worker interactions now requires the worker's 'download attachments' privilege when the file is an attachment, matching the web UI and REST API.

  • [Security/Install] Removed the unused '/install/phpinfo.php' diagnostic page, which could disclose PHP configuration if the 'install' directory wasn't deleted after installation. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API's workspace tab endpoint checking the tab's ID instead of its parent page when authorizing non-admin workers. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] The REST API's server and domain endpoints now require the worker's create, update, and delete privileges for those records, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Webhooks] New webhook listener URLs are now generated with a cryptographically secure random value. Previously they were derived from the listener name and creation time, which made them easier to guess. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API's snippet endpoints returning snippets the worker can't read. Retrieving and searching snippets now respects snippet ownership, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] The REST API's ticket update endpoint now requires the worker's ticket update privilege, and the close and delete privilege checks now always apply to the worker making the request. Previously, setting a new owner could make those checks use the owner's privileges instead. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Comments] Creating a comment now requires the worker's comment privilege for the target record type and read access to the target record. This is enforced everywhere comments are created: the comment editor, the records API, and the REST comment and note endpoints. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Attachments] Fixed an authorization gap where workers could gain download access to any attachment. Thanks to wranked.1 for the report!

  • [Security/REST] Fixed REST API endpoints that skipped group access checks, which let workers read, count, and delete messages in private groups they don't belong to. Thanks to wranked.1 for the report!

  • [Security/HTTP] Fixed outbound HTTP requests being able to reach cloud instance metadata services, which hand out credentials to anything that can make the server issue a request. This was blocked by the Cerb Cloud proxy but not Docker. Thanks to kta1kri for the report!

  • [Security/HTTP] Fixed legacy cURL requests not pinning the address that passed the cloud-metadata check, which DNS rebinding could get around.

  • [Security/Avatars] Fixed fetching an avatar image by URL being able to reach internal hosts. Only images on public addresses can be fetched now. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Dashboards] The URL datasource on workspace dashboard widgets now only fetches http:// and https:// URLs. Like other outbound requests, it can no longer reach cloud instance metadata services.

  • [Security/Dashboards] The URL datasource on workspace dashboard widgets now verifies TLS certificates for https:// URLs.

  • [Security/Support Center] Fixed the Contact Us form's CAPTCHA accepting submissions when no CAPTCHA image had been requested. The CAPTCHA now fails closed and each image allows only one attempt. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/HTTP] RSS feeds (feed reader and Support Center announcements) and the S3 Gatekeeper storage engine now verify TLS certificates. Removed the unused legacy OpenID 2.0 service, which also skipped certificate verification.

  • [Security/Snippets] Fixed the snippet editor's placeholder tester rendering values from records the worker can't read. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Cards] Testing a card widget template now requires administrator access, matching profile widgets.

  • [Security/Data Queries] Fixed worklist.records data queries returning records the active worker can't read, such as tickets in private groups they aren't a member of. This affected the /rest/data/query API and data query widgets. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] File custom fields set through the REST API's record endpoints now only accept files the worker can download, matching the web UI and the records API. Thanks to kta1kri for the report!

  • [Security/Automations] Opening a record's card popup now only triggers record.viewed automations when the worker can read the record, matching record profile pages. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Support Center] Knowledgebase article attachments can now only be downloaded from a Support Center portal that publishes the article's category. Previously, a KB article attachment could be downloaded from any portal by its file hash. Thanks to Adarify Group and kta1kri for the report!

  • [Security/Mail] Fixed the HTML email image proxy being able to reach internal hosts, including through redirects. Only images on public addresses can be fetched now. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Mail] The HTML email image proxy now requires the full URL signature. Previously, a shortened signature was accepted.

  • [Security/Install] Fixed the installer's setup steps being usable on an already-installed site when the 'install' directory was still reachable. Once a worker exists, these steps are blocked. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!