What's new in Teampass 3.2

Seven security advisories, four of them in LAPR, plus file integrity diagnostics, folder search and a Docker upgrade path that no longer leaves databases half-migrated.

Security

• LAPR endpoints are now scoped to the caller, so an operator can no longer attach an account to an endpoint whose SSH credential they cannot read (GHSA-mq4w-p2gw-pqp4)
• The SSH host key is verified before the credential is transmitted, closing a window where a man-in-the-middle received the plaintext password of a privileged account (GHSA-h25r-8cc9-2cg8)
• Deleting a managed account and changing its rotation policy now check folder scope, blocking a weak policy from being pushed to a privileged Linux account (GHSA-v7hq-28rv-qh3p)
• The API change feed no longer discloses instance-wide item ids and activity to a caller holding no folder rights (GHSA-9823-p8pg-rfm4)
• The item history detail is encoded where it is rendered, closing a stored cross-site scripting reachable from any edited field (GHSA-mwxw-gg4p-8xpc)
• The item login is rendered as text rather than markup (GHSA-47xg-w656-j4v4)
• Two entity-decoding helpers no longer build a live DOM node while decoding (GHSA-5vf9-rxqv-g8wp)
• The command palette applies item-level restrictions, so it no longer returns items the user cannot open

New

• File integrity and permission diagnostics in System Health, replacing the old unknown-files counter and its web deletion workflow with a read-only report
• A command-line integrity script for environments reachable only over SSH
• Folder results, a folder filter and a reset control on the search page
• Periodic checks of enrolled LAPR endpoints, and a pause that suspends rotations for one endpoint
• Repair my personal items encryption keys, in My Profile, for an owner whose internal reference key went missing

Improved

• The background key repair task now covers personal items, writing a key for their owner only
• Personal folders are excluded from key redistribution by their position in the tree, instead of a flag that legacy data never set
• An empty custom field is no longer reported as unreadable, and can be cleared again
• The One-Time View page decodes stored entities, so descriptions and logins render as written
• OAuth2 self-registration assigns the configured fallback role again
• The Docker container applies every intermediate upgrade step and records the version reached
• Published Docker images report the real version instead of the branch name
• Every Tools page query builds its table name from the configured prefix, restoring two repair tools on installations that do not use the default one
• Search no longer hides items sitting deep inside a personal folder
• A password changed through the API is recorded in the item history
• Item revision timestamps are returned wherever the revision is

Upgrade notes

• Schema change — the upgrade wizard runs on every installation
• Periodic LAPR endpoint checks stay off after an upgrade, so no outbound SSH starts without an administrator enabling it
• Updating an item password through the API can now be refused while encryption keys are still being distributed — retry, the message says so
• The web workflow that deleted unknown files is gone, replaced by the read-only report
• Back up the database before upgrading

LAPR — agentless rotation of Linux account passwords over SSH — plus item revisions for offline synchronization and three new notification types.

New

• LAPR (Linux Account Password Rotation) — Teampass generates a password from a policy, pushes it to the server over SSH, then re-encrypts the item, so the vault only ever records a password the machine actually accepted
• Agentless: nothing is installed on the target servers, and the existing item encryption model is reused rather than a parallel secret store
• Managed endpoints with host key trust on first use, reusable rotation policies, and manual or scheduled rotation that retries then suspends instead of hammering an unreachable host
• A dedicated audit log that never records a secret, and a separate "Can manage LAPR" permission held by non-administrators
• Item revisions and a delta endpoint for offline clients, with an optional precondition on update that rejects a conflicting write instead of overwriting it
• Notifications for local password expiry, knowledge base publication and backup failures
• Versioned Docker image tags — teampass/teampass:3.2.2.0 can now be pinned

Improved

• Search results open in a modal, with copy login and copy password directly on the row
• A page transition indicator covering navigation and slow AJAX, replacing the Pace plugin
• Browser-native confirmation dialogs replaced by the Teampass modal
• Personal folders no longer listed in the role, folder and user management screens
• Independent manual overrides for each web-server log path

Upgrade notes

• Schema change — the upgrade wizard runs on every installation
• LAPR is disabled by default, does nothing until an administrator enables it, and needs its own permission that no existing user receives on upgrade
• Back up the database before upgrading

Customizable email templates, server log reading on the Health page, and a refreshed Docker image clearing most of the vulnerabilities reported against it.

Security

• Upgrade wizard administrator check had no server-side effect — the grant is now kept server-side and required on every step
• Link secrets masked in the Health page log excerpts
• The client-side purifier split into inbound and outbound entry points, closing the class of XSS that assumed a purified value was safe to concatenate
• The WebDAV backup client no longer follows redirects, so Basic credentials cannot be replayed towards another host
• Vendored crypto-js updated to 4.2.0 (CVE-2023-46233)

New

• Customizable email templates — every subject and body rewritable per language, stored as a pure diff over the shipped strings
• Health page reading of the WebSocket and server access logs

Improved

• Docker base image moved to Alpine 3.24, clearing around 42 of the 48 open image alerts
• All Composer dependencies updated, clearing the five Dependabot advisories on guzzlehttp/guzzle
• Development dependencies are no longer part of an installation

Upgrade notes

• Schema change — the upgrade wizard runs on every installation and creates the email templates table
• An externalized WebDAV destination that relied on a redirect will stop working

A broad sweep of stored cross-site scripting sinks closed, and the client IP feeding the audit log and the bruteforce counter can no longer be forged.

Security

• Stored markup in folder titles imported from KeePass
• LDAP and OAuth2 identity fields neutralized before storage, and encoded in the directory sync screens
• Folder titles, folder paths and role names encoded in the roles matrix
• Item labels, recipient emails and task error messages encoded in attribute contexts
• WebSocket notification payloads escaped
• Item icons stored by the API before 3.2.1 can no longer inject markup
• The client IP used for security decisions is resolved through trusted proxies only
• Two earlier security fixes that had been applied to the wrong copy of a duplicated file are now actually served

Improved

• Accented names are stored with their accents, and names already in the database are realigned by the upgrade
• A sentinel test pins client-side HTML encoding at each sink, and another covers all 21 duplicated file pairs

Upgrade notes

• No table structure change, but three idempotent data migrations run once through the upgrade wizard
• The strict client IP resolution is opt-in — declare your trusted proxies to enable it

Two authorization bypasses closed, and the personal-to-shared item move rebuilt on a single hardened path shared by the web interface and the API.

Security

• Folder authorization was only checked on the first page of the items list, so asking for a later page returned the metadata of any folder, including other users' personal folders (GHSA-xrjw-r5hx-29rj)
• Item copy verified the rights on the source folder and never looked at the destination, letting any non-read-only user copy into an admin-restricted folder (GHSA-g797-4rh6-m2xp)

New

• Knowledge base entries searchable from the command palette
• The account avatar shown in the topbar

Improved

• The personal-to-shared item move is one hardened implementation — a missing source key now aborts the move instead of dropping the custom field
• The background task queue is visible on the Health page, and the task drain window is configurable
• The account creation email now reaches users created by their first LDAP login
• KeePass XML import no longer fails on entries with empty fields

Upgrade notes

• Code only — installations already on 3.2.1.4 are not sent through the upgrade wizard
• Anything automated against the items list must request the first page of a folder before asking for later pages

Faceted search, a Quick access panel, and a folder-scope authorization bypass in search closed.

Security

• Folder scope bypass in the search backend — the "limited" parameter replaced the accessible-folder scope instead of narrowing it, letting any authenticated user enumerate item metadata across folder boundaries
• Search scope now intersects the requested subtree with the folders the caller can reach, and subtracts other people's personal folders

New

• Faceted search — classification level, security flags, attachments, dates, rotation, tags, scope, favourites, recently viewed and unencrypted custom fields
• Item restrictions moved into SQL, so filtering happens before the row limit rather than after it
• Quick access panel replacing the sidebar: recent, most used and favourites, ranked per user

Improved

• Health page accuracy and backup reliability
• Version differences between instances no longer raise backup anomaly warnings
• Server-side filtering and a "Password changed" column on the security posture flagged-items list
• Login page repairs itself after a session expires, and renews keys silently when a tab regains focus

Upgrade notes

• Schema change — the upgrade wizard runs on every installation
• Back up the database before upgrading

Administrator control over authentication lockouts, KeePass 2.x XML export and a native PowerShell API client.

New

• Administrator management of authentication lockouts
• KeePass 2.x XML export
• Native PowerShell API client
• Configurable minimum password length
• "Not assessed" password health state for uncomputed metadata

Improved

• Redesigned operational statistics dashboard
• Security scans no longer abort on malformed legacy passwords
• Item password health measured from the live value

Security

• Authorization boundary tightened — holding a sharekey is not an access grant
• Role assignment scoped to the caller's own roles

Active Directory nested groups restored and two authorization defects closed.

Security

• Missing authorization in the folder update action (GHSA-66q9-mxf2-xqw6)
• Personal items disclosed through key generation

Improved

• Active Directory group mapping with nested-group support in both login modes
• API folder rights aligned with the web interface
• Folder password complexity exposed through the API

The first stable build of the 3.2.1 line — modern cryptography, a security posture dashboard and governance features, plus nine advisories closed.

Encryption

• Authenticated AES-256-GCM with random IVs and per-secret salts
• PBKDF2 raised from 1,000 to 600,000 iterations, HKDF-SHA256 added
• Object keys widened from 64 to 256 bits
• Personal folders readable only by their owner and the recovery account
• Lazy re-encryption of existing secrets, with progress tracking

New

• Security Posture Dashboard and personal security score
• Access Recertification Campaigns with immutable decisions
• Compliance reports and CSV evidence export
• Leaver / offboarding risk identification
• Rotation policy and overdue tracking
• Four-level data classification and item ownership
• Secure Send — expiring, view-limited external sharing
• Importers for Bitwarden, LastPass, 1Password and KeePassXC
• Configurable RFC 6238 TOTP profiles
• Ctrl-K command palette and in-app notification centre
• First-run onboarding wizard

Security

• Unauthenticated MFA reset and authentication oracles (GHSA-6x6x-v79m-v5x3)
• Unauthenticated forced password reset (GHSA-cm5h-m2xm-5pxr)
• Folder access bypass in item details (GHSA-hjhc-6g7v-8jxr)
• Legacy unguarded user update branches (GHSA-58ph-5gg6-h2v8)
• Unscoped role assignment (GHSA-gjc5-pmxw-58p4)
• Stored XSS through the API (GHSA-r298-6mxv-j9hc)
• User logs IDOR (GHSA-qhff-v9qj-75wc)
• Decoupled authorization in downloadFile (GHSA-3f3c-cw29-xxm7)
• Import module authorization (GHSA-cgcj-f9rx-c8r4)

Upgrade notes

• PHP 8.2 is now the minimum supported version
• Every new feature is seeded disabled on upgrade
• The hardened encryption format stays off after an upgrade until you enable it
• Back up the database before running remediation scripts

Four advisories closed, including a privilege escalation and an OAuth2 bypass.

Security

• Mass-assignment privilege escalation in user management (GHSA-x8jf-9g87-j232)
• OAuth2 authentication bypass (GHSA-2mvr-v9w8-34c7)
• SQL injection in the user-logs datatable (GHSA-fqg6-xvv8-w228)
• Authenticated path traversal in file upload (GHSA-wwxq-c766-v93w)

Improved

• Folder-level rights enforced consistently on bulk operations