What's Changed

This is a maintenance and security release on the 3.2.1 line. It closes a folder authorization advisory, fixes a personal-item key redistribution that could expose other users' personal credentials, makes Active Directory group ↔ role mapping work again (broken since 3.1.7.2) with full nested-group support, and aligns the API folder rights with the web interface. Upgrading is recommended for all installations, and required for anyone using Active Directory group mapping or personal folders.

No new feature has to be enabled and no table is altered: the upgrade only runs two one-shot, idempotent data migrations (see Upgrade notes).

🔒 Security fixes

• Missing authorization in the update_folder action (GHSA-66q9-mxf2-xqw6) - folders.queries.php had no authenticated-session gate, and update_folder never checked that the caller could access the folder it was modifying. Any authenticated non-read-only user could re-parent an arbitrary folder and convert it to personal, moving another team's credential subtree into their own personal space and hiding it from the whole organization. The handler is now behind a global session gate, the target folder and the new parent must both belong to the caller's accessible folders, and cross-domain (shared ↔ personal) moves are rejected.
• Personal items disclosed to other users through key generation - since the personal-folder fix of 3.2.1.0, the internal recovery account holds a decryption key on every personal item. The "the owner has no sharekey" guard used by create_user_keys therefore stopped protecting other users' personal items: every account whose keys were (re)generated inherited a valid key on all existing personal items, which surfaced other people's personal credentials, in the Security Posture scan, for example. Key generation now excludes other users' personal folders at every step, the posture queries are scoped by folder as well as by sharekey, and the remediation also covers items stored in a personal folder whose perso flag was still 0. Existing data is cleaned automatically during the upgrade (see Upgrade notes).

🛠️ Improvements

• Active Directory group mapping fixed and nested groups supported (PR #5302, @RealPurePurple) - getADGroups() built the objectGUID string in wire byte order while getUserADGroups() used LdapRecord's Guid class and its Windows mixed-endian layout. The identifiers stored by the admin mapping never matched the ones resolved at login, so no AD group could be mapped to a role — broken since 3.1.7.2, when the byte-order fix was applied to only one of the two call sites. Both conversions are now aligned on LdapRecord\Models\Attributes\Guid, the default GUID attribute is objectguid (Active Directory has no gidNumber), nested memberships are resolved with LDAP_MATCHING_RULE_IN_CHAIN with a fallback to direct membership for directories without the extended matching rule, the user DN is escaped before entering a filter, and a failed membership lookup is reported as an error instead of being read as "no group", which used to strip every AD role from the user.
• Nested groups now resolved in both login group check modes - Active Directory populates memberOf with direct membership only, so ldap_allowed_login_group_mode = user denied access to anyone inheriting the allowed group through a nested one, while the group-centric mode accepted them. The user-centric mode now falls back to a scope=base read filtered on the reverse matching rule, only on the path that would otherwise deny access, a direct member still costs no extra query. No configuration change is required after the upgrade: the setting becomes a pure performance trade-off, and its tip has been updated accordingly (EN, FR).
• API folder rights aligned with the web interface - folder access is resolved through the shared least-permissive-wins evaluator (a folder granted both R and W now yields R), and ND / NE / NDNE are enforced on item update and delete. AD-sourced roles are taken into account, administrators get every shared folder, and explicitly forbidden folders are subtracted from the accessible list. Folder create/update also gained fixes: access_rights defaults to W, empty titles are rejected, the complexity level is validated on update, and both writes are wrapped in a transaction with the tree rebuild and cache refresh moved after the commit.
• Folder password complexity exposed by the API - GET /api/v1/folder/listFolders and GET /api/v1/folder/writableFolders now return a complexity field (0 | 20 | 38 | 48 | 60), so a client such as the browser extension can generate a password that satisfies the folder's minimum strength before submitting it. 0 is returned for folders carrying no complexity rule, personal roots included.
• teampass-cli.sh actually shipped - the Bash API client announced in 3.2.1.1 was swallowed by an unanchored *.sh rule in .gitignore and never reached the repository. It now lives in the released tree as app/scripts/teampass-cli.sh, the documentation paths follow, and it is registered in both file-integrity manifests.
• Web-root permission model clarified - the permissions documentation asked for every file to be owned by the web server user, which contradicted the "app/ and public/ must not be writable" check: with 0755 and www-data as owner, the web server can still write. Both ownership models (simple and split-owner) are now documented, and the upgrade wizard's misleading chmod 0755 hint is replaced with an ownership-based fix that actually clears the warning.

🐛 Bug fixes

• Legacy sharekey purge deleting the wrong rows - the 20231017_1 upgrade operation and its runtime twin deleted sharekeys_files, sharekeys_fields and sharekeys_logs rows by item id, while object_id references files.id, categories_items.id and log_items.increment_id respectively. The purge therefore missed its targets and could remove unrelated keys. All three statements now resolve the right object ids.
• "Restore missing sharekeys" rebuilding keys for everyone on personal items - the tool excluded personal items on the items.perso flag alone, so an item stored in a personal folder whose flag was still 0 had its keys rebuilt for every user. It now identifies personal items by their folder as well.

⬆️ Upgrade notes

• upgrade_run_3.2.1.php gains two one-shot data migrations, each guarded by its own marker so it never runs twice, and both idempotent. No ALTER TABLE, no schema change.
  • AD group identifier realignment - existing ldap_groups_roles rows are converted to the canonical GUID format. Only installs with ldap_type = ActiveDirectory using objectGUID are touched; identifiers that are not canonical GUIDs are left untouched.
  • Personal sharekeys remediation - the foreign keys wrongly held on personal items are removed. The engine is the one behind app/scripts/remediate_personal_sharekeys.php: it never deletes anything for an item whose owner is ambiguous. Running the script by hand is no longer necessary; it remains available with --dry-run for admins who want to inspect first.
• UPGRADE_MIN_DATE was raised, so installations already running 3.2.1.0 or 3.2.1.1 are sent back through the upgrade wizard to pick both migrations up. This is expected, the upgrade is idempotent.
• Active Directory users: check your group ↔ role mappings after upgrading. The stored identifiers are converted in place, but the mapping never worked before this release, so it is worth confirming that each AD group now resolves to the intended role.
• Back up your database before upgrading, as always.

Full Changelog: 3.2.1.1...3.2.1.2

Important

• Requires at least PHP 8.2

Languages

Please join Teampass v3 translation project on Poeditor and translate it for your language.

Installation

Follow instructions from Documentation.