i was doing an upgrade of our passbolt ce server installation this morning using “sudo apt --only-upgrade install passbolt-ce-server”. that worked as well as all times before, but obviously the pro version was installed…
here’s a small snippet from the apt output of what was installed: “passbolt-ce-server all 5.13.0-1”.
system information:
os: ubuntu 24.04.4 lts
webserver: nginx 1.24.0
db: mysql 8.0.46-0
php: 8.3.6
passbolt: 5.13.0
healthcheck-copy (shortend):
Environment
[INFO] Linux password 6.17.0-1018-azure #18~24.04.1-Ubuntu SMP Thu May 28 16:39:11 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
[PASS] PHP version 8.3.6.
[PASS] PHP version is 8.2 or above.
[PASS] 64-bit architecture system detected.
[INFO] gpg (GnuPG) 2.4.4 / libgcrypt 1.10.3
[PASS] PCRE compiled with unicode support.
[PASS] Mbstring extension is installed.
[PASS] Intl extension is installed.
[PASS] GD or Imagick extension is installed.
[PASS] The temporary directory and its content are writable and not executable.
[PASS] The logs directory /var/log/passbolt/ and its content are writable.
[PASS] System clock is synchronized and NTP service is active.
Application configuration
[PASS] Using latest passbolt version (5.13.0).
[PASS] Passbolt is configured to force SSL use.
[PASS] App.fullBaseUrl is set to HTTPS.
[PASS] Selenium API endpoints are disabled.
[PASS] Search engine robots are told not to index content.
[INFO] The Self Registration plugin is enabled.
[INFO] Registration is closed, only administrators can add users.
[WARN] The deprecated self registration public setting was found in /etc/passbolt/passbolt.php.
[HELP] You may remove the “passbolt.registration.public” setting.
[WARN] Host availability checking is disabled.
[HELP] Make sure this instance is not publicly available on the internet.
[HELP] Or set the PASSBOLT_EMAIL_VALIDATE_MX environment variable to true.
[HELP] Or set passbolt.email.validate.mx to true in /etc/passbolt/passbolt.php.
[PASS] Serving the compiled version of the javascript app.
[WARN] Some email notifications are disabled by the administrator.
[PASS] The database schema is up to date.
[FAIL] Subscription invalid/expired (The users limit is exceeded.).
[PASS] The edition served is PRO.
expected behaviour:
well, i expected to update the community edition not do upgrade to pro…
yet no chance to reproduce this for me…
i have to mention, that " upon once upon a time" we migrated from pro to ce.
addition:
on our backup-system, which is actually a separated fully functional installation, happend the same. so it was reproducable.
Checklist
I have read intro post: https://community.passbolt.com/t/about-the-installation-issues-category/12
I have read the tutorials, help and searched for similar issues
I provide relevant information about my server (component names and versions, etc.)
I provide a copy of my logs and healthcheck
I describe the steps I have taken to trouble shoot the problem
I describe the steps on how to reproduce the issue
This is expected behavior, not an accidental upgrade to Pro.
In 5.13 you can now manage the edition directly from the product, without installing a different package or running another Docker image. What you’re likely hitting: after your earlier Pro to CE migration, a subscription key was left on file in /etc/passbolt. 5.13 detects it and serves Pro to avoid silently downgrading a Pro instance and risking data loss.
Could you confirm a couple of things:
Is there still a subscription key file in /etc/passbolt (e.g. subscription_key.txt)?
Is your instance still up and reachable?
If it’s up, you should be able to restore CE directly from the admin screen using the downgrade CTA: https://PASSBOLT_INSTANCE/app/administration/subscription/
If it’s not reachable, let us know and we’ll provide the command to do it from the CLI.
Also, hi and thanks for this report! Clearly this is an unexpected upgrade for you. Just be careful not to get tempted by the Pro features from here on
“Downgrading” to CE worked as expected. Thanks for your help and the fast replies!
There are only two questions, that still bother me a bit:
Why could i not see the downgrade option under “../administration/subscription/”? (Seems as this is due to the used browser. Firefox with me, while my boss used Chrome…)
And will this possibly happen again with the next update? Just in case it would be nice to have the CLI command for “downgrading to CE” available.
Hi. I have the same problem after updating to 5.13 in docker. I still reach the site but i couldnät find the downgrade to Community button and I could’t find any old files for subscripttion. healthscheck says: [FAIL] Subscription invalid/expired (The users limit is exceeded.).
[PASS] The edition served is PRO.
there must be a subscription key stored as `/etc/passbolt/subscription_key.txt` or legacy-wise under `/etc/passbolt/license`.
Regardless of this, there is a command to enforce the downgrade to CE. This is a destructive action for all PRO-related data persisted in your database. You want to perform a backup of your DB prior to running this command. You will be prompted to provide your username as `-u` argument.
Note also that this command will log you out, as well as all other users.
@cooky : The edition downgrade does not need to be run on every package upgrade. Once you downgraded from PRO to CE, the edition will remain CE until you upload a valid subscription key.
