Email settings appear empty after upgrade to 5.14 CE from 5.13.4 CE

2Face · August 3, 2026, 2:23pm

Checklist
I have read intro post: https://community.passbolt.com/t/about-the-installation-issues-category/12
I have read the tutorials, help and searched for similar issues
I provide relevant information about my server (component names and versions, etc.)
I provide a copy of my logs and healthcheck
I describe the steps I have taken to trouble shoot the problem
I describe the steps on how to reproduce the issue

Hi Community,

I recently Updated my passbolt instance from 5.13.4 CE to 5.14 CE and I noticed that when I opened the settings for my email server configuration it was empty. Although after doing the Upgrade I received emails as normal. I had setup MailGun as my provider. I love the support for more email providers that has been added and the new UI.

This occurred only after I opened the settings page.
Even though it shows nothing is configured I still receive emails without any issue.

OS - Ubuntu 24.04.4 LTS
PHP version - 8.5.9

 ____                  __          ____  
/ __ \____  _____ ____/ /_  ____  / / /_ 

/ // / __ `/ / / __ / __ / / _/
/ / // (  |  ) // / // / / /
//    _,///./_//__/

Open source password manager for teams

Healthcheck shell
If you want to have more information about the different checks, please take a look at the documentation: https://www.passbolt.com/docs/admin/server-maintenance/passbolt-api-status/.........................

Environment

[INFO] Linux passboltsg2 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
[PASS] PHP version 8.5.9.
[PASS] PHP version is 8.2 or above.
[PASS] 64-bit architecture system detected.
[INFO] gpg (GnuPG) 2.4.4 / libgcrypt 1.10.3
[PASS] PCRE compiled with unicode support.
[PASS] Mbstring extension is installed.
[PASS] Intl extension is installed.
[PASS] GD or Imagick extension is installed.
[PASS] The temporary directory and its content are writable and not executable.
[PASS] The logs directory /var/log/passbolt/ and its content are writable.
[PASS] System clock is synchronized and NTP service is active.

Config files

[PASS] The application config file is present
[PASS] The passbolt config file is present

Core config

[PASS] Cache is working.
[PASS] Debug mode is off.
[PASS] Unique value set for security.salt
[PASS] Full base url is set to https://pbolt.rlab.win
[PASS] App.fullBaseUrl validation OK.
[PASS] /healthcheck/status is reachable.

SSL Certificate

[PASS] SSL peer certificate validates.
[PASS] Hostname is matching in SSL certificate.
[PASS] Not using a self-signed certificate.

SMTP settings

[PASS] The SMTP Settings plugin is enabled.
[PASS] SMTP Settings coherent. You may send a test email to validate them.
[PASS] The SMTP Settings source is: database.
[PASS] The SMTP Settings plugin endpoints are disabled.
[PASS] No custom SSL configuration for SMTP server.

JWT Authentication

[PASS] The JWT Authentication plugin is enabled.
[PASS] The /etc/passbolt/jwt/ directory is not writable.
[PASS] A valid JWT key pair was found.

GPG Configuration

[PASS] PHP GPG Module is installed and loaded.
[PASS] The environment variable GNUPGHOME is set to /var/lib/passbolt/.gnupg.
[PASS] The directory /var/lib/passbolt/.gnupg containing the keyring is writable by the webserver user.
[PASS] The server OpenPGP key is not the default one.
[PASS] The public key file is defined in /etc/passbolt/passbolt.php and readable.
[PASS] The private key file is defined in /etc/passbolt/passbolt.php and readable.
[PASS] The server key fingerprint matches the one defined in /etc/passbolt/passbolt.php.
[PASS] The server public key defined in the /etc/passbolt/passbolt.php (or environment variables) is in the keyring.
[PASS] There is a valid email id defined for the server key.
[PASS] The public key can be used to encrypt a message.
[PASS] The private key can be used to sign a message.
[PASS] The public and private keys can be used to encrypt and sign a message.
[PASS] The private key can be used to decrypt a message.
[PASS] The private key can be used to decrypt and verify a message.
[PASS] The public key can be used to verify a signature.
[PASS] The server public key format is Gopengpg compatible.
[PASS] The server private key format is Gopengpg compatible.

Application configuration

[PASS] Using latest passbolt version (5.14.0).
[PASS] Passbolt is configured to force SSL use.
[PASS] App.fullBaseUrl is set to HTTPS.
[PASS] Selenium API endpoints are disabled.
[PASS] Search engine robots are told not to index content.
[INFO] The Self Registration plugin is enabled.
[INFO] Registration is closed, only administrators can add users.
[PASS] The deprecated self registration public setting was not found in /etc/passbolt/passbolt.php.
[PASS] Host availability will be checked.
[PASS] Serving the compiled version of the javascript app.
[WARN] Some email notifications are disabled by the administrator.
[PASS] The database schema is up to date.
[PASS] The edition served is CE.

Database

[PASS] The application is able to connect to the database
[PASS] 53 tables found.
[PASS] Some default content is present.
[PASS] The database version is supported.
[PASS] The model schema cache shows no discrepancies with the database schema.

Metadata

[PASS] The server does not have access to the server metadata private key in Zero-knowledge mode.

[PASS] No error found. Nice one, sparky!

Thomas1 · August 5, 2026, 12:43pm

Hi 2Face,
Thanks for the detailed report and healthcheck output,
In your healthcheck, interestingly I see “The SMTP Settings plugin endpoints are disabled”, which means that the settings are from passbolt.php and not UI (database). Also, it means that the endpoint is disabled and therefore, you can’t edit the settings from the user interface which can potentially lead into this weird behavior.

As I mention, it’s because your SMTP configuration was set directly in passbolt.php rather than through the UI. We recommend using the UI version since the settings will be encrypted with your server public key in the database, and it prevents on the settings from file.

Potentially, what could solve the issue could be:

In your passbolt.php you should have passbolt.security.smtpSettings.endpointsDisabled set to true, you can change this value to false.
Then go to the administration settings in the UI and re-enter your MailGun configuration there, and save.
Send a test email to confirm it’s working.
- What you can double check also is by running this SQL query: SELECT * FROM organization_settings WHERE property = "smtp"\G you should see a pgp message.
Once confirmed the settings are saved in the database and confirmed working, except if you really have a reason to block the smtp endpoint, you can revert the settings back to true.

Let me know if the settings page still appears empty after this, hope this will help.
Thomas,

2Face · August 5, 2026, 1:12pm

Hi Thomas,

Thank you for your help.

Yes I remember disabling the SMTP endpoint somewhere around version 5.10 - 5.12.

But I distinctly remember configuring the email settings from the Web UI and not the config file.

I just checked the config file and yes SMTP endpoint is disabled but there are no credentials for the email server set up in the config.

Edit 1:

I just ran the DB query you provided and yes SMTP settings are stored in the DB

Thomas1 · August 6, 2026, 9:03am

Hi 2Face,
Thanks for your reply, let’s dig a bit further.
Could you check the console logs? Open the browser console in the extension (right-click the extension icon > Inspect, or via the debug/developer tools) to see if any error is thrown when the page tries to fetch the SMTP configuration? That will tell us more about the issue.
Also, one thing worth checking: have you rotated your server’s GPG key since you first configured the SMTP settings through the UI? Since those settings are stored encrypted in the database with your server’s public key, a key rotation would explain why they now appear empty (the app can no longer decrypt what was stored).
If you haven’t rotated the key, could you try setting passbolt.security.smtpSettings.endpointsDisabled back to false in passbolt.php, save, and then re-enter your SMTP configuration through the UI and save. If you don’t see any errors, the settings are saved and your emails keeps working, you should be able to turn the settings back to false. In case you face an error, can you please share any output that could help me investigating further?
Thanks,
Thomas

pegimenez · August 6, 2026, 1:34pm

Hi Thomas1!

You mentioned “We recommend using the UI version since the settings will be encrypted with your server public key in the database, and it prevents on the settings from file.” but when you run a health check from UI under SMTP comfiguration section if the endpoints are not disable you will get an alert sugesting to disable this.

What should be the recommended way to configure this?

Thanks!

BR.

Pablo.

Thomas1 · August 7, 2026, 7:57am

Hello pegimenez,
Hope your doing good.
Yes that’s right, what we recommend is using the UI because its goes directly in the database. But as it is an open endpoint we still need to put a warn on it, if you are sure the smtp setting won’t move you can put back “passbolt.security.smtpSettings.endpointsDisabled” to true to have the check passing again. Hope this clarify things.
Cheers,
Thomas

2Face · August 8, 2026, 5:49am

Hi Thomas1,

Sorry for the delay.
I see there is one error in the console when I open the Email Server config.

Thomas1 · August 10, 2026, 1:33pm

Hello 2face!
Hope you had a great week-end!

Could you please try setting “passbolt.security.smtpSettings.endpointsDisabled” to false. Then, you should be able to enter your settings in the UI and save it. As mentioned in our documentation (in the red danger box) if you are confident that the SMTP settings won’t move you can iterate afterwards on “passbolt.security.smtpSettings.endpointsDisabled” to true.

Now, regarding the error in the console, I’m a little bit surprised that you run into this issue, I’ve seen similar behavior of this case after a server key rotation where the encrypted message can’t be decrypted anymore since it was encrypted with the old key. Have you recently rotated your server keys?

Tell me how its goes, have a great day.

Best regards,