Releases »

12.0 »

12.0.2

Cerb (12.0.2) is a maintenance update released on October 30, 2026. It includes 20 minor features, fixes, and security patches from community feedback covering the 12.0 update. You can follow these instructions to upgrade.

Changelog

Changed

  • [Installer/Update] The updater now checks the database user's privileges and the storage engine's features before applying patches, like the installer already did. An upgrade from a much older version on an outdated server now fails with a clear error instead of partway through the patches.

Fixed

  • [Platform/Database] Fixed MariaDB compatibility by no longer using the MySQL 8-only UUID_TO_BIN() and BIN_TO_UUID() functions.

  • [Platform/HTTP] Fixed Guzzle 7.11+ deprecation notices about passing CURLOPT_PROTOCOLS_STR in the "curl" request option. Outbound HTTP requests and cloud storage now restrict URLs to http and https using the "protocols" request option instead.

  • [Platform/PHP] Fixed a "Using null as an array offset" deprecation notice when preloading records for placeholders.

  • [Platform/HTTP] Fixed a Guzzle 7.11+ deprecation notice about passing CURLOPT_FOLLOWLOCATION in the "curl" request option.

  • [Composer] Updated Guzzle to 7.16.1, fixing a guzzlehttp/promises 2.6 deprecation notice about Promise\Is::pending().

Security

  • [Security/Support Center] Fixed Support Center requesters being able to remove other participants from a shared ticket. Requesters may now only remove their own addresses, and can no longer add participants from the portal. Thanks to kta1kri for the report!

  • [Security/Records] Fixed missing authorization checks when adding or removing record links, viewing link counts and linked records, and toggling yourself as a watcher. Workers now need edit access to the source record and read access to linked records. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Watchers] Fixed the watchers popup showing a record's label and watchers to workers without read access to the record. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API ticket merge endpoint not enforcing write access to every merged ticket or the merge privilege. Thanks to kta1kri for the report!

  • [Security/Support Center] Fixed the contact form adding Cc: participants to an existing ticket when the subject contained its mask, and accepting a subject or Cc: recipients when those fields are disabled. Thanks to kta1kri for the report!

  • [Security/Automations] Fixed the built-in ticket interactions for assigning, moving, and adding/removing participants not checking that the current worker can modify the ticket. Thanks to kta1kri for the report!

  • [Security/Records] Fixed editing a record through its editor not checking that the worker can modify the existing record, only its new owner. This affected worklists, custom fields, snippets, email signatures, calendars, saved searches, custom fieldsets, project boards, custom records, and workspace widgets. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/SSO] Fixed OpenID Connect sign-in not rejecting disabled workers. Login completion now rejects disabled workers for every authentication method. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/HTTP] Fixed legacy cURL requests not pinning the address that passed the cloud-metadata check, which DNS rebinding could get around.

  • [Security/Avatars] Fixed fetching an avatar image by URL being able to reach internal hosts. Only images on public addresses can be fetched now. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API's link and unlink endpoints only requiring read access. Workers now need edit access to the 'on' record and read access to each target, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Records] Linking a custom fieldset now requires edit access to the records it is added to. Moving a project board card now requires edit access to both columns and read access to the card.

  • [Security/Notifications] Fixed workers being able to read other workers' notifications through the REST API and record searches. Notifications are now readable only by their owner and admins. Thanks to Muhammad Harley for the report!

  • [Security/Dependencies] Upgraded symfony/mime to 8.1.10 and other Composer dependencies in response to security advisories.