Releases »

12.0 »

12.0.1

Cerb (12.0.1) is a maintenance update released on October 21, 2026. It includes 13 minor features, fixes, and security patches from community feedback covering the 12.0 update. You can follow these instructions to upgrade.

Changelog

Removed

  • [Security/Dashboards] Removed the URL datasource from workspace dashboard widgets. Counter, gauge, and pie chart widgets can no longer fetch their data directly from a URL. They should use data queries or automations for external URL access instead.

  • [Support Center/Security] Removed email address sharing from the Support Center. Contacts now see only the conversations where one of their own email addresses is a participant.

Fixed

  • [Mail] Fixed outgoing HTML mail failing to send when an embedded inline image couldn't be read from storage.

  • [Platform/HTTP] Fixed an issue where outbound HTTP requests failed with a fatal error on servers with libcurl older than 7.85 (e.g. the default on RHEL 8 and 9), which broke integrations like Elasticsearch. The http/https protocol restriction now falls back to the older cURL options when the newer ones are unavailable. Thanks to Karson @ KnownHost for the report.

Security

  • [Security/HTTP] Updated cURL options to use string-based protocols for enhanced safety. Thanks to kta1kri for the report!

  • [Security/Platform/HTTP] Replaced bare Guzzle client with shared HTTP client to ensure proper proxy, timeout, and egress configurations. Thanks to kta1kri for the report.

  • [Security/Support Center] Fixed an authorization gap in the legacy Support Center portal. Thanks to kta1kri and wranked.1 for the report.

  • [Security/Tickets] Fixed an authorization gap where the ticket editor and reply drafts didn't enforce per-ticket group permissions. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/REST] Fixed OAuth2 access to the REST API continuing to work for workers who were deactivated. Deactivated workers are now rejected on the OAuth2 path (matching legacy API keys), and their OAuth2 access and refresh tokens are revoked on deactivation. Thanks to wranked.1 for the report!

  • [Security/REST] Fixed REST API endpoints that skipped group access checks, which let workers read, count, and delete messages in private groups they don't belong to. Thanks to wranked.1 for the report!

  • [Security/Attachments] Fixed an authorization gap where workers could gain download access to any attachment. Thanks to wranked.1 for the report!

  • [Security/HTTP] Fixed outbound HTTP requests being able to reach cloud instance metadata services, which hand out credentials to anything that can make the server issue a request. This was blocked by the Cerb Cloud proxy but not Docker. Thanks to kta1kri for the report!

  • [Security/Dependencies] Upgraded phpseclib/phpseclib to 3.0.57, league/commonmark to 2.10.3, and enshrined/svg-sanitize to 1.0.0 in response to security advisories.