This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
+5 more
Affected surfaces
ReleasePort's take
Moderate signalAdmin permissions have shifted from a per‑user model to a group‑based system; existing staff members are automatically placed into temporary groups during the transition.
Why it matters: The permission architecture change requires administrators to review and reassign group memberships for all staff before managing access, or risk unauthorized privilege gaps. Review is mandatory post‑upgrade.
Summary
AI summaryUpdates 🐛 Bug Fixes, 📈 Enhancements, and 📦 Dependencies across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Server manager credentials now masked in API responses and admin UI. Server manager credentials now masked in API responses and admin UI. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | High |
Stripe webhooks now require a signing secret when webhook mode is enabled; server manager input handling hardened. Stripe webhooks now require a signing secret when webhook mode is enabled; server manager input handling hardened. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | Medium |
Extension configuration pages require `manage_settings` permission; existing staff groups backfilled with this permission. Extension configuration pages require `manage_settings` permission; existing staff groups backfilled with this permission. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Breaking | High |
Admin permissions reworked from per-user to group-based model; existing staff migrated to temporary groups. Admin permissions reworked from per-user to group-based model; existing staff migrated to temporary groups. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Stripe supports recurring subscriptions via Setup Intents and webhooks, handling subscription lifecycle events and invoice payments. Stripe supports recurring subscriptions via Setup Intents and webhooks, handling subscription lifecycle events and invoice payments. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Administrators and clients can set a per‑user timezone; dates in app and emails respect the configured timezone. Administrators and clients can set a per‑user timezone; dates in app and emails respect the configured timezone. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Client profile forms gain a country code selector and number formatter. Client profile forms gain a country code selector and number formatter. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Knowledge base migrated to Doctrine with improved search, article listing, view counts, and canned response management. Knowledge base migrated to Doctrine with improved search, article listing, view counts, and canned response management. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Staff notification emails (new order, ticket, signup) can be scoped to specific admin groups instead of all staff. Staff notification emails (new order, ticket, signup) can be scoped to specific admin groups instead of all staff. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Administrators can edit their own ticket replies with full revision history for auditability. Administrators can edit their own ticket replies with full revision history for auditability. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Custom client fields now sorted alphabetically; maximum increased from 10 to 20 fields. Custom client fields now sorted alphabetically; maximum increased from 10 to 20 fields. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
PDF invoices can be attached to invoice emails for bank‑transfer clients. PDF invoices can be attached to invoice emails for bank‑transfer clients. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Invoice reminder intervals are configurable before and after due date. Invoice reminder intervals are configurable before and after due date. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Custom client IDs exposed in API and admin UI. Custom client IDs exposed in API and admin UI. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Discord community button added to admin header. Discord community button added to admin header. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Suspended client status badges now use a ribbon‑style visual distinction. Suspended client status badges now use a ribbon‑style visual distinction. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Order creation validates prices, preventing invalid or missing price data from reaching payment gateways. Order creation validates prices, preventing invalid or missing price data from reaching payment gateways. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Rate limit counters can be viewed and reset via new admin panel UI and API. Rate limit counters can be viewed and reset via new admin panel UI and API. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Feature | Low |
Zero‑price orders can generate invoices for record‑keeping. Zero‑price orders can generate invoices for record‑keeping. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Dependency | Low |
Updated Twig to v3.28.0. Updated Twig to v3.28.0. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updated CKEditor 5 to v48.3.0. Updated CKEditor 5 to v48.3.0. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed MySQL 8.0.22+ REGEXP charset conflict causing database patches 67 and 74 to fail during upgrades. Fixed MySQL 8.0.22+ REGEXP charset conflict causing database patches 67 and 74 to fail during upgrades. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed ticket and knowledge‑base messages losing content when angle brackets were typed; now sanitized with Markdown‑safe approach. Fixed ticket and knowledge‑base messages losing content when angle brackets were typed; now sanitized with Markdown‑safe approach. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
DirectAdmin account deletion now recovers from false‑negative API errors by verifying removal before reporting failure. DirectAdmin account deletion now recovers from false‑negative API errors by verifying removal before reporting failure. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Low |
Third‑party registrar adapters now load correctly after installation despite Composer's optimized autoloader. Third‑party registrar adapters now load correctly after installation despite Composer's optimized autoloader. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Outgoing HTTP requests from the update checker now include a User-Agent header; admin UI text corrected. Outgoing HTTP requests from the update checker now include a User-Agent header; admin UI text corrected. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Twig render failures now return proper 500 error pages instead of blank screens. Twig render failures now return proper 500 error pages instead of blank screens. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Servicehosting admin template no longer errors when order actions are missing. Servicehosting admin template no longer errors when order actions are missing. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Renewal invoices now use the order's edited price instead of the product's base price. Renewal invoices now use the order's edited price instead of the product's base price. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Renewals are skipped for invoice items that already have a pending payment, preventing duplicate charges. Renewals are skipped for invoice items that already have a pending payment, preventing duplicate charges. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Cron settings defaults now populate correctly on fresh installs. Cron settings defaults now populate correctly on fresh installs. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
| Bugfix | Low |
Repeated PayPal `subscr_signup` IPNs no longer create duplicate subscription records. Repeated PayPal `subscr_signup` IPNs no longer create duplicate subscription records. Source: granite4.1:30b@2026-07-15-audit Confidence: high |
— |
Full changelog
0.8.4
Installations that have not yet upgraded from older releases should treat 0.8.4 as the recommended security baseline. It is recommended to upgrade from earlier versions as soon as possible.
⚠️ Potentially Breaking Changes
- Admin permissions have been reworked from per-user permissions to a group-based model. Existing staff members are migrated to temporary groups on upgrade. Custom modules or themes that check permissions directly may need updating. (#3821, #3885, #3890)
🔐 Security
- Server manager credentials (passwords, API keys) are now masked in API responses and throughout the admin UI. (#3840)
- Extension configuration pages now require the
manage_settingspermission. Existing staff groups are backfilled with this permission to preserve prior behavior for upgrading installs. (#3856, #3890) - Stripe webhooks now require a webhook signing secret when webhook mode is enabled, and server manager input handling has been hardened. (#3962)
📈 Enhancements
- Stripe now supports recurring subscriptions via Setup Intents and webhooks, including handling of subscription lifecycle events and invoice payments. (#3455, #3857)
- Client profile forms gain a country code selector and number formatter. (#3812)
- The knowledge base has been migrated to Doctrine with improved search, article listing alongside categories, view counts, and better canned response management. (#3808)
- Administrators and clients can now set a per-user timezone. Dates throughout the app and in email notifications respect the configured timezone. (#3895)
- Staff notification emails (new order, ticket, signup) can now be scoped to specific admin groups instead of always going to every staff member. (#3899)
- Administrators can edit their own ticket replies, with full revision history kept for auditability. (#3906)
- Custom client fields are now sorted alphabetically in forms, and the maximum has been raised from 10 to 20 fields. (#3909)
- PDF invoices can now be attached to invoice emails, so clients paying by bank transfer can view the invoice without logging in. (#3913)
- Invoice reminder intervals are now configurable — customize when reminders are sent before and after the due date. (#3914)
- Custom client IDs are now exposed in the API and admin UI. (#3922)
- A Discord community button has been added to the admin header. (#3865)
- Suspended client status badges now use a ribbon-style for better visual distinction. (#3936)
- Order creation now validates prices, preventing invalid or missing price data from reaching payment gateways. (#3952)
- Rate limit counters can now be viewed and reset from the admin panel via a new management UI and API. (#3953)
- Zero-price orders can now generate invoices for record-keeping purposes. (#3958)
🐛 Bug Fixes
- Fixed a MySQL 8.0.22+ REGEXP charset conflict that could cause database patches 67 and 74 to fail during upgrades. (#3822)
- Fixed ticket and knowledge base messages silently losing content when users typed angle brackets (e.g.
<World>) — content is now sanitized with a Markdown-safe approach instead of an HTML sanitizer. (#3830) - Fixed third-party registrar adapters not being loaded after installation due to Composer's optimized autoloader not discovering the files. (#3832)
- Outgoing HTTP requests from the update checker now include a User-Agent header, and the update path text in the admin UI has been corrected. (#3861)
- Twig render failures are now returned as proper 500 error pages instead of blank screens. (#3874)
- The Servicehosting admin template no longer errors when order actions are missing. (#3880)
- Renewal invoices now use the order's edited price instead of the product's base price. (#3893)
- DirectAdmin account deletion now recovers from false-negative API errors by verifying the account was actually removed before reporting failure. (#3894)
- Renewals are now skipped for invoice items that already have a pending payment, preventing duplicate charges. (#3905)
- Cron settings defaults now populate correctly on fresh installs. (#3911)
- Repeated PayPal
subscr_signupIPNs no longer create duplicate subscription records. (#3927) - The Product Promotions admin page no longer crashes for promo rows with NULL flags from legacy installs. (#3946)
- Domain orders paid with account credit during checkout no longer trigger a duplicate activation attempt. (#3948)
- Upgrading from 0.6.x no longer fails with an undefined method error in
UpdatePatcherafter the Extension module's Doctrine migration. (#3949) - PayPal IPN callback handling has been refined for improved edge case reliability. (#3957)
- Several email and payment edge cases have been fixed, including uncancel emails, zero-credit payment handling, and DirectAdmin apostrophe entity decoding. (#3959)
📝 Changes
- Admin groups and permissions have been reworked into a Doctrine-backed group model with per-group permission sets. (#3821)
- The Email, Extension, and Support modules have been migrated to Doctrine ORM. (#3863, #3879)
- Document fields (passport, driver's license, etc.) have been migrated to use the custom client fields system. (#3839)
- Frontend JavaScript has been migrated to TypeScript. The public API bundle continues to ship as compiled JavaScript. (#3950)
📦 Dependencies
- Update Twig to v3.28.0 (#3881)
- Update CKEditor 5 to v48.3.0 (#3872)
- Update Sentry SDK to v4.29.0 (#3864)
- Update Stripe PHP to v20.3.0 (#3835)
- Update PostCSS to v8.5.16 (#3862)
- Update Autoprefixer to v10.5.2 (#3841)
- Update Rector to v2.5.0 (#3814)
- Update
actions/cacheto v6 (#3831) - Update
docker/setup-compose-actionto v2.3.0 (#3871)
Full Changelog: https://github.com/FOSSBilling/FOSSBilling/compare/0.8.3...0.8.4
Breaking Changes
- Admin permissions reworked from per‑user to a group‑based model; existing staff migrated to temporary groups on upgrade. Custom modules or themes checking permissions directly may need updating.
Security Fixes
- Server manager credentials (passwords, API keys) are now masked in API responses and throughout the admin UI (#3840).
- Extension configuration pages now require the `manage_settings` permission; existing staff groups are backfilled with this permission to preserve prior behavior for upgrading installs (#3856, #3890).
- Stripe webhooks now require a webhook signing secret when webhook mode is enabled and server manager input handling has been hardened (#3962).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About FOSSBilling
Hosting and billing automation. Integrates with WHM, CWP, cPanel and HestiaCP. Full API and easily extensible.
Beta — feedback welcome: [email protected]