What's new in Teampass 3.2

Two access-control advisories, idempotent item creation and deletion in the API, and a self-service trial of the browser extension licence.

Security

• The REST API applies item-level restrictions, so a user excluded from an item can no longer read its password or its TOTP code, nor update or delete it (GHSA-gxc6-rgv6-wx99)
• Item access is granted only for a folder of the user's own scope, closing a path where a grant on a subfolder gave read access to the passwords of its parent (GHSA-jr9q-x7pj-8qh9)
• The API tag list is scoped to the items the caller can read, instead of returning the tags of every folder in the instance

New

• Self-service trial of the browser extension licence, requested from the Licence tab of the API settings, with an offline path by e-mail, clipboard or QR code for an instance with no Internet access
• Idempotent item creation and conditional deletion in the REST API, so a client that lost the response can retry without creating a second item
• A search field in the LDAP synchronization user list

Improved

• Twenty production dependencies refreshed, among them phpseclib 3.0.57, Guzzle 7.15.5, the Symfony 6.4.45 components and TCPDF 6.11.4
• The Docker image applies the Alpine security updates at build time, and is rebuilt every week so an unchanged release keeps receiving them

Fixed

• Monitoring logs honour the selected search column, and the Errors, Copy, Admin and Failed logins purges apply the selected account instead of deleting the entries of every account
• A newly created folder appears in the Items tree without a manual refresh
• Renaming, moving or changing the icon of a folder from the Items page no longer resets its special options and its renewal period, and a new subfolder inherits them from its parent
• The background task log is written again, and two task handlers can no longer run at once
• The file integrity check no longer warns about the background tasks lock file
• The login form accepts one submission at a time
• The admin dashboard no longer reports an enabled scheduled backup as missing, and the new version available notice stops showing after an upgrade

Upgrade notes

• Schema change, the upgrade wizard runs once on every installation
• Let running background tasks finish before replacing the files, the handler lock file is now kept instead of deleted
• API clients no longer receive the items the caller is restricted from, and the tag list only covers readable items
• Re-check the special options and the renewal period of the folders you renamed or moved from the Items page
• Back up the database before upgrading

Hotfix — the administration page shipped inert in 3.2.2.2, killed by a JavaScript syntax error.

Fixed

• The administration page works again, a template emitted two declarations on a single output line and the whole script block failed to parse
• The regression guard meant to catch that shape no longer misses a declaration sitting at column zero

Upgrade notes

• No schema change of its own, an installation already running 3.2.2.2 is not sent back through the upgrade wizard

An unauthenticated entry point to the background scheduler, a leftover installation table holding the administrator password in clear text, and a Docker upgrade path that could leave a container unable to log in.

Security

• The background scheduler wrapper sitting in the web root is removed, and the scheduler itself refuses any invocation that does not come from a command line (GHSA-fpv9-jxph-qg96)
• The temporary installation table holding the administrator password in clear text is now really dropped, by the installer and by the upgrade
• Client-side sanitization helpers rewritten after CodeQL findings, among them an entity decoder that turned a stored escape back into a live quote

Improved

• The admin dashboard information card becomes Actions required, and disappears entirely when there is nothing to act on
• Five dismissible getting-started recommendations for a fresh installation
• The file integrity manifest no longer lists the development metadata vendored inside dependencies

Fixed

• A Docker container no longer skips a patch migration and ends up unable to log in
• The command palette returns items again, its restriction clause targeted the wrong table alias

Upgrade notes

• Data migration without any table alteration, the upgrade wizard runs once on every installation
• A crontab calling the scheduler over HTTP now gets a 404, the supported invocation has always been the command line one
• Back up the database before upgrading

Seven security advisories, four of them in LAPR, plus file integrity diagnostics, folder search and a Docker upgrade path that no longer leaves databases half-migrated.

Security

• LAPR endpoints are now scoped to the caller, so an operator can no longer attach an account to an endpoint whose SSH credential they cannot read (GHSA-mq4w-p2gw-pqp4)
• The SSH host key is verified before the credential is transmitted, closing a window where a man-in-the-middle received the plaintext password of a privileged account (GHSA-h25r-8cc9-2cg8)
• Deleting a managed account and changing its rotation policy now check folder scope, blocking a weak policy from being pushed to a privileged Linux account (GHSA-v7hq-28rv-qh3p)
• The API change feed no longer discloses instance-wide item ids and activity to a caller holding no folder rights (GHSA-9823-p8pg-rfm4)
• The item history detail is encoded where it is rendered, closing a stored cross-site scripting reachable from any edited field (GHSA-mwxw-gg4p-8xpc)
• The item login is rendered as text rather than markup (GHSA-47xg-w656-j4v4)
• Two entity-decoding helpers no longer build a live DOM node while decoding (GHSA-5vf9-rxqv-g8wp)
• The command palette applies item-level restrictions, so it no longer returns items the user cannot open

New

• File integrity and permission diagnostics in System Health, replacing the old unknown-files counter and its web deletion workflow with a read-only report
• A command-line integrity script for environments reachable only over SSH
• Folder results, a folder filter and a reset control on the search page
• Periodic checks of enrolled LAPR endpoints, and a pause that suspends rotations for one endpoint
• Repair my personal items encryption keys, in My Profile, for an owner whose internal reference key went missing

Improved

• The background key repair task now covers personal items, writing a key for their owner only
• Personal folders are excluded from key redistribution by their position in the tree, instead of a flag that legacy data never set
• An empty custom field is no longer reported as unreadable, and can be cleared again
• The One-Time View page decodes stored entities, so descriptions and logins render as written
• OAuth2 self-registration assigns the configured fallback role again
• The Docker container applies every intermediate upgrade step and records the version reached
• Published Docker images report the real version instead of the branch name
• Every Tools page query builds its table name from the configured prefix, restoring two repair tools on installations that do not use the default one
• Search no longer hides items sitting deep inside a personal folder
• A password changed through the API is recorded in the item history
• Item revision timestamps are returned wherever the revision is

Upgrade notes

• Schema change — the upgrade wizard runs on every installation
• Periodic LAPR endpoint checks stay off after an upgrade, so no outbound SSH starts without an administrator enabling it
• Updating an item password through the API can now be refused while encryption keys are still being distributed — retry, the message says so
• The web workflow that deleted unknown files is gone, replaced by the read-only report
• Back up the database before upgrading

LAPR — agentless rotation of Linux account passwords over SSH — plus item revisions for offline synchronization and three new notification types.

New

• LAPR (Linux Account Password Rotation) — Teampass generates a password from a policy, pushes it to the server over SSH, then re-encrypts the item, so the vault only ever records a password the machine actually accepted
• Agentless: nothing is installed on the target servers, and the existing item encryption model is reused rather than a parallel secret store
• Managed endpoints with host key trust on first use, reusable rotation policies, and manual or scheduled rotation that retries then suspends instead of hammering an unreachable host
• A dedicated audit log that never records a secret, and a separate "Can manage LAPR" permission held by non-administrators
• Item revisions and a delta endpoint for offline clients, with an optional precondition on update that rejects a conflicting write instead of overwriting it
• Notifications for local password expiry, knowledge base publication and backup failures
• Versioned Docker image tags — teampass/teampass:3.2.2.0 can now be pinned

Improved

• Search results open in a modal, with copy login and copy password directly on the row
• A page transition indicator covering navigation and slow AJAX, replacing the Pace plugin
• Browser-native confirmation dialogs replaced by the Teampass modal
• Personal folders no longer listed in the role, folder and user management screens
• Independent manual overrides for each web-server log path

Upgrade notes

• Schema change — the upgrade wizard runs on every installation
• LAPR is disabled by default, does nothing until an administrator enables it, and needs its own permission that no existing user receives on upgrade
• Back up the database before upgrading