New release: 5.14.0 ~ "Sunshine" | Browser Extension & API

What’s in Passbolt 5.14.0?

Passbolt 5.14.0 Sunshine introduces explicit permission confirmation prompts to improve control over shared resources. This release also addresses a security issue related to MFA policy enforcement and includes usability improvements.

Improved Sharing Transparency

Users now receive an explicit confirmation dialog before creating items in shared folders or editing shared resources. This provides full permission transparency before changes take effect, preventing accidental privilege exposure.

Previously, when a group appeared in the access list, its individual members were not visible, making it difficult to assess the actual reach of shared access. Group members are now displayed directly within the dialog before finalizing permission changes.

As the first stage of a broader security initiative, future updates will extend these confirmations to folder move operations and offer enhanced permission preview dialogs.

Edition and Subscription Management

The Passbolt edition is now visible in the application footer, and Terms and Credits links have moved to the main navigation menu.

Additionally, whenever administrators downgrade to the Community edition they will be explained the impact on data and features beforehand so they can make an informed decision.

More Relevant Resource Suggestions

Suggested resources in the browser extension are now ranked using an improved URL relevance algorithm. Exact URL matches appear first, followed by parent paths and domain matches, allowing users to select the correct credentials faster and with fewer autofill errors.

Security Improvements

This release addresses a low-severity vulnerability that allowed a user with a valid account and MFA access to remember their device for a month even when the organisation had disabled that option. Reported by security researcher Damir, the issue affected Passbolt API versions up to 5.13.0 and is now enforced correctly at the API level in 5.14.0.

Additional Improvements

Passbolt Pro extends email-free account setup and recovery to OIDC and ADFS SSO providers, improving onboarding by integrating directly with enterprise identity management systems.

Finally, this release also lays the foundational backend architecture required for upcoming offline functionality.

Conclusion

Many thanks to Damir and everyone who provided feedback, reported bugs, and contributed to making Passbolt better!

Changelogs

Platform: Browser Extension & API
Name: Sunshine | Browser Extension & API

Release notes: https://www.passbolt.com/changelog/api-bext/sunshine-browser-extension-api-2
Release Date: July 28, 2026
Song: :musical_notes:Sunshine :musical_notes:

Enjoy Passbolt? Leave us a :star::star::star::star::star: review:
Chrome | Firefox | Edge | iOS | Android | Windows

Thank you to everyone who tested, reported, and shaped this release.
Your feedback helps keep Passbolt simple, secure, and open. :heart:

3 Likes

Good morning, I’ve noticed that with server version 5.14.0 and the browser extension 5.14.2 (Free Edition), there’s an issue with creating passwords in Chrome. It returns the following error: “Missing or incorrect CSRF cookie type.”
This doesn’t happen in Firefox. Has anyone else encountered this problem?