What’s in Passbolt 5.15.0?
Passbolt 5.15.0 improves form detection for autofill, makes permission changes easier to review, and adds several security and administration improvements. This release also introduces new session management tooling and additional safeguards for Passbolt Pro.
Clearer permission confirmation changes
Permission changes are now easier to understand before they take effect, helping users avoid accidental access changes. New badges clearly show whether a permission is being added, modified, or deleted, so users can see exactly what will change at a glance.
Deleted permissions can also be rolled back to their original state before confirmation, making access changes easier to review and adjust.
Improved autofill detection
Autofill now works more reliably on modern websites that were previously unsupported. Improved form detection helps users fill credentials more consistently and with less manual effort, resulting in a smoother autofill experience.
This is the first step in a broader series of autofill improvements, with upcoming releases focused on reducing false positives and further refining form classification. A technical blog article explaining those improvements in detail will be published after the next release.
Security
Invalidate JSON authentication token for disabled users
Disabling a user now cuts off their access straight away when they are signed in with JWT authentication, as was already the case for other authentication methods. Previously, a user who had just been disabled could keep using the API for up to 5 minutes. Only the mobile application and power users with a custom API integration were affected.
Last login dates only available for administrators
Privacy has also been strengthened by restricting users’ last login dates to administrators only, reducing unnecessary exposure of sensitive account activity.
SCIM administrators protected against deletion (Pro Edition)
SCIM providers can no longer delete Passbolt administrators by default, helping prevent an identity provider from accidentally locking an administrator out.
Organisations that intentionally manage administrator removal through SCIM can disable this protection by updating their configuration.
If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:
[...]
// plugins configuration.
'plugins' => [
'scim' => [
'security' => [
'allowDeleteAdministrators' => true
]
],
],
[...]
If you installed Passbolt with docker, you can use the following environment variable:
PASSBOLT_PLUGINS_SCIM_SECURITY_ALLOW_DELETE_ADMINISTRATORS=true
SSRF protection for SSO provider URLs (Pro Edition)
SSO provider integration is now blocked from accessing internal or private network addresses, reducing the risk of malicious or misconfigured redirects. A new healthcheck flags when the protection is disabled. It remains off by default for backward compatibility and will become the default in a future release.
Organizations that would want to enforce could already do it by configuration.
If you installed Passbolt with packages, open /etc/passbolt/passbolt.php and add or update the plugins section:
[...]
'security' => [
'sso' => [
'egress' => [
// Master switch for the SSRF guard
'enabled' => true,
// Enforce vs. warn-only
// true blocks the connection
// false logs a warning but still connects
'block' => true,
// Turn the always-blocked category on/off (link-local + cloud metadata)
'blockLinkLocal' => true,
// Turn the private-range category on/off (loopback, RFC1918, unique local addresses, carrier-grade NAT)
'blockPrivateRanges' => true,
// Exact IPs allowed to bypass the private-range block only (never link-local/metadata)
// Comma-separated string, i.e. '10.10.5.20, 10.10.5.21'
'privateRangeAllowedIps' => null,
],
],
],
[...]
If you installed Passbolt with docker:
PASSBOLT_SECURITY_SSO_EGRESS_GUARD_ENABLED=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_ENABLED=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_LINK_LOCAL=true
PASSBOLT_SECURITY_SSO_EGRESS_BLOCK_PRIVATE_RANGES=true
PASSBOLT_SECURITY_SSO_EGRESS_PRIVATE_RANGE_ALLOWED_IPS="10.10.5.20, 10.10.5.21"
Performance and database-stored sessions (Beta)
Warning: this feature is still in beta and is not recommended for production use. If you do try it, we would be glad to hear your feedback. Keep in mind that enabling this feature can increase your server load, so consider it carefully before doing so.
Passbolt API can now store sessions in the database, improving performance by removing file-based session locking and simplifying high-availability deployments.
Administrators that want to test can enable the feature manually via configuration:
Update Session.defaults configuration in the passbolt.php file:
[...]
'Session' => [
[...]
'defaults' => 'database', // Set this to database
],
[...]
Or if you installed Passbolt with docker, set SESSION_DEFAULTS env var:
SESSION_DEFAULTS=database
Miscellaneous Improvements
Administrators are now notified whenever any user is deleted, giving them better visibility into account removals across the organisation. Previously, notifications were sent only when an administrator was deleted.
Conclusion
Many thanks to Luca Crippa for the security report on the JSON authentication token issue, Ashik Mohamed for the report on the SCIM administrator issue, and meifukun for the report on SSRF protection for SSO provider URLs, and to everyone who provided feedback, reported bugs, and contributed to making passbolt better!
Changelog
Platform: Browser Extension & API
Name: Who Is He | Browser Extension & API
Release notes: https://www.passbolt.com/changelog/api-bext/who-is-he-browser-extension-api
Release Date: August 21, 2026
Song: 
Who Is He
Enjoy Passbolt? Leave us a 
review:
Chrome | Firefox | Edge | Safari | iOS | Android | Windows
Thank you to everyone who tested, reported, and shaped this release.
Your feedback helps keep Passbolt simple, secure, and open. 