Skip to content

Poweradmin

v4.3.3 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo DNS & Service Discovery
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

dns-administration pdns powerdns powerdns-admin powerdns-web-gui powerdns-webui
+1 more
web

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal
editorial:auto 1mo

The Poweradmin v4.3.3 release hardens API permissions and adds critical security mitigations for CSV exports.

Why it matters: Permission validation on /users endpoints blocks self‑elevation; CSV export quoting prevents spreadsheet formula injection, a severity‑70 issue affecting any exported data.

Summary

AI summary

Updates API-backend mode, API permissions and authorization, and Templates and zones across a mixed release.

Changes in this release

Security Critical

Permission templates validated on /users create/update to prevent self‑elevation.

Permission templates validated on /users create/update to prevent self‑elevation.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Security High

Zone listing scoped to zones the requesting user can actually see, preventing full zone leakage.

Zone listing scoped to zones the requesting user can actually see, preventing full zone leakage.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Security High

DNSSEC operations now require full edit permission and zone ownership before execution.

DNSSEC operations now require full edit permission and zone ownership before execution.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Security High

CSV exports now quote cells that begin with special characters to prevent spreadsheet formula injection.

CSV exports now quote cells that begin with special characters to prevent spreadsheet formula injection.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Medium

SOA, NS, and apex records are pinned to the top of zone record listings in both standard and API‑backend modes.

SOA, NS, and apex records are pinned to the top of zone record listings in both standard and API‑backend modes.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Medium

Record ID column and its toggle are hidden in API‑backend mode where the value isn’t meaningful.

Record ID column and its toggle are hidden in API‑backend mode where the value isn’t meaningful.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Low

Fresh Docker containers can optionally initialize the PowerDNS schema for empty databases.

Fresh Docker containers can optionally initialize the PowerDNS schema for empty databases.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Low

Zone template sync clears stale zone_template_sync rows when a zone's template changes and reconciles sync for all owners of a shared zone.

Zone template sync clears stale zone_template_sync rows when a zone's template changes and reconciles sync for all owners of a shared zone.

Source: granite4.1:30b@2026-06-07-audit

Confidence: low

 —
Bugfix Medium

Database consistency checks are skipped when using the PowerDNS API backend, avoiding false errors.

Database consistency checks are skipped when using the PowerDNS API backend, avoiding false errors.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Medium

Dashboard stats panel continues working when PowerDNS tables are unavailable.

Dashboard stats panel continues working when PowerDNS tables are unavailable.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Medium

Record search query now qualifies ORDER BY column to avoid ambiguous‑column errors and sorts grouped results by aggregate alias for PostgreSQL.

Record search query now qualifies ORDER BY column to avoid ambiguous‑column errors and sorts grouped results by aggregate alias for PostgreSQL.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Low

LUA template records are now applied to IPv4 reverse zones.

LUA template records are now applied to IPv4 reverse zones.

Source: granite4.1:30b@2026-06-07-audit

Confidence: low

 —
Bugfix Low

Add‑zone flow retains reverse‑zone context as you progress through it.

Add‑zone flow retains reverse‑zone context as you progress through it.

Source: granite4.1:30b@2026-06-07-audit

Confidence: low

 —
Full changelog

✨ Highlights

Patch release for the 4.3.x line. Focus is permission and authorization hardening across the API and DNSSEC, API-backend mode polish (record ordering, dashboard resilience, consistency checks), template sync correctness, and Docker schema initialization for fresh containers.

🐛 Fixes

API permissions and authorization

  • Permission templates are validated on /users create and update so a user can no longer self-elevate by assigning a higher template, and accounts with broken templates are surfaced (#1219).
  • Zone listing in both the internal and V1 APIs is scoped to zones the requesting user can actually see, instead of leaking the full zone set.
  • DNSSEC operations now require full edit permission and zone ownership before they can run.

Authentication URLs

  • OIDC and SAML callback, post-logout, and SP/API-docs base URLs are pinned to interface.application_url instead of being derived from request headers, so they stay correct behind proxies and can't be influenced by client-supplied host headers.

API-backend mode

  • Database consistency checks are skipped when running against the PowerDNS API backend, where the local tables they inspect don't apply (#1292).
  • Dashboard stats panel keeps working when the PowerDNS tables are unavailable.
  • SOA, NS, and apex records are pinned to the top of the zone record list regardless of sort column or direction, in both the standard and API-backend listings (#1250).
  • Record ID column and its toggle are hidden in API mode where the value isn't meaningful (#1319).

Templates and zones

  • LUA template records are now applied to IPv4 reverse zones (#1248).
  • Zone template sync clears stale zone_template_sync rows when a zone's template changes (#1249) and reconciles sync for all owners of a shared zone.
  • Add-zone flow keeps reverse-zone context as you move through it (#1225).

Search and exports

  • Record search qualifies the ORDER BY column to fix an ambiguous-column error (#1224) and sorts grouped results by their aggregate alias for PostgreSQL.
  • CSV exports quote cells that begin with special characters to prevent spreadsheet formula injection.

Docker

  • Fresh containers initialize the MySQL/PostgreSQL schema on first start, and can optionally initialize the PowerDNS schema for empty databases (#1307).

Localization

  • Remaining validation, DNSSEC, and record messages are translated, and the new API-backend consistency-check notice is added and translated.

📦 Upgrading

Drop-in replacement for v4.3.2. PHP 8.2+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.3.2...v4.3.3

Security Fixes

  • Permission templates validated on `/users` create/update prevent self‑elevation by assigning higher templates.
  • Zone listing in internal and V1 APIs now respects user permissions, eliminating zone leakage.
  • DNSSEC operations enforce full edit permission and ownership, closing unauthorized access vectors.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Poweradmin

Get notified when new releases ship.

Sign up free

About Poweradmin

A web-based control panel for PowerDNS

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]