Releases »

12.0 »

12.0.3

Cerb (12.0.3) is a maintenance update released on November 05, 2026. It includes 26 minor features, fixes, and security patches from community feedback covering the 12.0 update. You can follow these instructions to upgrade.

Changelog

Changed

  • [API/Attachments] Files uploaded through the REST API are now linked to the uploading worker, the same as the web UI, so they can be attached to comments, drafts, and messages.

  • [Calendars] Calendars are now readable by all workers, matching how worklists and availability widgets already shared them. Previously, a worker-owned calendar's profile page was only viewable by its owner. Editing and deleting calendars still requires ownership.

  • [Mail/HTML Templates] HTML email templates are now readable by all workers, matching how the reply, compose, and broadcast template pickers already shared them. Editing and deleting templates still requires ownership.

Fixed

  • [Mail/Compose] Pasting or inserting an image in the compose or reply editor while in plain text switches the editor to HTML (Markdown) formatting again.

Security

  • [Security/Login] Account recovery now fails closed when a secret question is missing its question or answer. Saving a secret question now requires both a question and an answer. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] The REST API's attachment download endpoint now requires the worker's 'download attachments' privilege, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Interactions] The file download prompt in worker interactions now requires the worker's 'download attachments' privilege when the file is an attachment, matching the web UI and REST API.

  • [Security/Install] Removed the unused '/install/phpinfo.php' diagnostic page, which could disclose PHP configuration if the 'install' directory wasn't deleted after installation. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API's workspace tab endpoint checking the tab's ID instead of its parent page when authorizing non-admin workers. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] The REST API's server and domain endpoints now require the worker's create, update, and delete privileges for those records, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Webhooks] New webhook listener URLs are now generated with a cryptographically secure random value. Previously they were derived from the listener name and creation time, which made them easier to guess. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] Fixed the REST API's snippet endpoints returning snippets the worker can't read. Retrieving and searching snippets now respects snippet ownership, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] The REST API's ticket update endpoint now requires the worker's ticket update privilege, and the close and delete privilege checks now always apply to the worker making the request. Previously, setting a new owner could make those checks use the owner's privileges instead. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Comments] Creating a comment now requires the worker's comment privilege for the target record type and read access to the target record. This is enforced everywhere comments are created: the comment editor, the records API, and the REST comment and note endpoints. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Support Center] Fixed the Contact Us form's CAPTCHA accepting submissions when no CAPTCHA image had been requested. The CAPTCHA now fails closed and each image allows only one attempt. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/HTTP] RSS feeds (feed reader and Support Center announcements) and the S3 Gatekeeper storage engine now verify TLS certificates. Removed the unused legacy OpenID 2.0 service, which also skipped certificate verification.

  • [Security/API] The REST API's task endpoints now respect task project access. Retrieving and searching tasks hides tasks in projects the worker can't read, and updating a task requires write access to its project, matching the web UI. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Snippets] Fixed the snippet editor's placeholder tester rendering values from records the worker can't read. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Cards] Testing a card widget template now requires administrator access, matching profile widgets.

  • [Security/Data Queries] Fixed worklist.records data queries returning records the active worker can't read, such as tickets in private groups they aren't a member of. This affected the /rest/data/query API and data query widgets. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/API] File custom fields set through the REST API's record endpoints now only accept files the worker can download, matching the web UI and the records API. Thanks to kta1kri for the report!

  • [Security/Automations] Opening a record's card popup now only triggers record.viewed automations when the worker can read the record, matching record profile pages. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Support Center] Knowledgebase article attachments can now only be downloaded from a Support Center portal that publishes the article's category. Previously, a KB article attachment could be downloaded from any portal by its file hash. Thanks to Adarify Group and kta1kri for the report!

  • [Security/Mail] Fixed the HTML email image proxy being able to reach internal hosts, including through redirects. Only images on public addresses can be fetched now. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/Mail] The HTML email image proxy now requires the full URL signature. Previously, a shortened signature was accepted.

  • [Security/Install] Fixed the installer's setup steps being usable on an already-installed site when the 'install' directory was still reachable. Once a worker exists, these steps are blocked. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!