passbolt/passbolt_api

Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!

View on Packagist

View on Github

Activity

Latest release: 3w ago
Total releases: 175
Cadence: ~13 days
Last 12 months: 15

Reach

Stars: 6.1k

Details

License: unknown
First release: Mar 21, 2016

Releases

Version	Released
`v5.15.0` minor	Aug 20, 2026
`v5.14.3` patch	Aug 06, 2026
`v5.14.0` minor	Jul 20, 2026
`v5.13.0` minor	Jun 11, 2026
`v5.12.0` minor	May 12, 2026
`v5.11.0` minor	Apr 09, 2026
`v5.10.0` minor	Mar 11, 2026
`v5.9.0` minor	Jan 26, 2026
`v5.8.0` minor	Dec 22, 2025
`v5.7.2` patch	Nov 17, 2025
`v5.7.1` patch	Nov 14, 2025
`v5.7.0` minor	Nov 12, 2025
`v5.6.1` patch	Nov 04, 2025
`v5.6.0` minor	Oct 08, 2025
`v5.6.0-rc.1` pre	Oct 06, 2025
`v5.5.2` patch	Sep 29, 2025
`v5.5.0` minor	Sep 15, 2025
`v5.5.0-rc.1` pre	Sep 12, 2025
`v5.4.1` patch	Aug 13, 2025
`v5.4.0` minor	Aug 12, 2025
`v5.4.0-rc.1` pre	Aug 11, 2025
`v5.3.2` patch	Jul 17, 2025
`v5.3.1` patch	Jul 09, 2025
`v5.3.0` minor	Jul 09, 2025
`v5.3.0-rc.1` pre	Jul 04, 2025
`v5.2.0` minor	Jun 11, 2025
`v5.2.0-rc.1` pre	Jun 05, 2025
`v5.1.1` patch	May 22, 2025
`v5.1.0` minor	May 15, 2025
`v5.1.0-rc.1` pre	May 12, 2025
`v5.0.0` major	Apr 10, 2025
`v5.0.0-rc.2` pre	Apr 08, 2025
`v5.0.0-rc.1` pre	Apr 07, 2025
`v4.12.1` patch	Mar 17, 2025
`v4.12.0` minor	Mar 12, 2025
`v4.12.0-rc.1` pre	Mar 06, 2025
`v4.11.1` patch	Feb 17, 2025
`v4.11.0` minor	Jan 30, 2025
`v4.10.1` patch	Nov 26, 2024
`v4.10.0` minor	Nov 20, 2024
`v4.10.0-rc.1` pre	Nov 14, 2024
`v4.9.1` patch	Aug 14, 2024
`v4.9.0` minor	Jul 23, 2024
`v4.9.0-rc.1` pre	Jul 18, 2024
`v4.8.0` minor	May 21, 2024
`v4.8.0-rc.1` pre	May 17, 2024
`v4.7.0` minor	Apr 30, 2024
`v4.7.0-rc.1` pre	Apr 26, 2024
`v4.6.2` patch	Apr 11, 2024
`v4.6.1` patch 1 CVE	Mar 27, 2024

1–50 of 175

Repository

passbolt/passbolt_api

Forks: 393
Open issues: 22
Language: PHP
: 4.1/ 10

password-manager
passbolt
security
cakephp
productivity
php

Dependencies (20)

Depends on

v5.15.0

Supply-chain exposure

Known CVEs (7)

GHSA-qm5v-pj64-852j May 20, 2024

Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

5.5 / 10
Medium
Network Low Low Required Unchanged Low Low Low

Description

A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object.

Impact of issue

The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data.

Fix

The code that opens a new window via window.open(); now open the tab with the noopener attribute.

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 44 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.10.0v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1v2.7.0v2.7.1v2.7.2v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.9.0

Fixed in

2.11.0

References

https://github.com/passbolt/passbolt_api/commit/f568e113beb3134446eda9e66400d28d726ee20d
https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-08-07-3.yaml
https://github.com/passbolt/passbolt_api
https://www.passbolt.com/incidents/20190807_multiple_vulnerabilities

Updated Dec 05, 2024 · Source: OSV.dev
GHSA-2f46-4xjm-73x5 May 20, 2024

Passbolt API Stored XSS on first/last name during setup

7.2 / 10
High
Network Low High None Unchanged High High High

Description

An administrator can craft a user with a malicious first name and last name, using a payload such as

<svg onload="confirm(document.domain)">'); ?></svg>

The user will then receive the invitation email and click on the setup link. The setup start page served by the server will fire the XSS.

Impact of issue

An administrator could use this exploit to edit the setup start page for a given user, for example, trick the user into installing another extension. Even though the severity of this issue in itself is high, the likelihood is low because the exploit will be visible in clear by the user in the email notification, and also requires an action from a malicious administrator.

Fix

Sanitize the firstname and lastname in the page that is used to trigger the extension setup process.

Additionally since v2.11 some default CSP are inserted in the server response headers to prevent inline-scripts or 3rd party domain scripts on pages served by the passbolt API. This is to cater for the case where the administrator has not set them up as part of the web server configuration.

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 44 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.10.0v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1v2.7.0v2.7.1v2.7.2v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.9.0

Fixed in

2.11.0

References

https://github.com/passbolt/passbolt_api/commit/6135b483f72c6853e6085e329f5f8d7be60c9933
https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-08-07-1.yaml
https://github.com/passbolt/passbolt_api
https://github.com/passbolt/passbolt_api/blob/master/CHANGELOG.md#2110---2019-08-08
https://www.passbolt.com/incidents/20190807_multiple_vulnerabilities

Updated Dec 05, 2024 · Source: OSV.dev
GHSA-cv5c-2qv5-w2m2 May 20, 2024

Passbolt Api Remote code execution

8.1 / 10
High
Network High None None Unchanged High High High

Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.

The impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 33 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1

Fixed in

2.7.0

References

https://github.com/passbolt/passbolt_api/commit/be84671676ebac43d49e326a14f1afe259777611
https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-1.yaml
https://github.com/passbolt/passbolt_api
https://www.passbolt.com/incidents/20190211_multiple_vulnerabilities

Updated Dec 05, 2024 · Source: OSV.dev
GHSA-f5pp-pmq8-gp46 May 20, 2024

Passbolt Api Retrieval of HTTP-only cookies

3.7 / 10
Low
Network High None None Unchanged Low None None

Passbolt uses three cookies: a session cookie, a CSRF protection cookie and a cookie to keep track of the multiple-factor authentication process.

Both the session cookie and the mfa cookie are properly set HTTP-only to prevent an attacker from retrieving the content of those cookies if they managed to exploit an XSS.

The /auth/verify.json endpoint returns a JSON that, among other things, contains the cookies sent in the request. (similar to the TRACE HTTP method)

An attacker who manages to leverage an XSS vulnerability could retrieve the session cookies of a legitimate user, effectively granting them the ability to retrieve information (such as encrypted password list or group list) without requiring user interaction.

This vulnerability has a low impact, but no immediate risk due to it requiring the exploitation of an XSS vulnerability that has yet to be found.

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 33 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1

Fixed in

2.7.0

References

https://github.com/passbolt/passbolt_api/commit/fbf99fed4b60db5fec97b58a2251a04bb42c1b15
https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-2.yaml
https://github.com/passbolt/passbolt_api
https://www.passbolt.com/incidents/20190211_multiple_vulnerabilities

Updated Dec 05, 2024 · Source: OSV.dev
GHSA-v86m-j5f7-ccwh May 20, 2024

Passbolt Api E-mail HTML injection

4.4 / 10
Medium
Network High Low Required Changed Low Low None

Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.

Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.

An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.

This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 33 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1

Fixed in

2.7.0

References

https://github.com/passbolt/passbolt_api/commit/00f0ebe37d78815adee26d5e80cf2250fe878647
https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-3.yaml
https://github.com/passbolt/passbolt_api
https://www.passbolt.com/incidents/20190211_multiple_vulnerabilities

Updated Dec 05, 2024 · Source: OSV.dev
CVE-2024-33670 GHSA-2pg6-vw9c-qhjv Apr 26, 2024

Passbolt API allows HTML injection

4.3 / 10
Medium
Network Low None Required Unchanged Low None None

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 114 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.10.0v2.11.0v2.12.0v2.12.1v2.13.0v2.13.0-RC1v2.13.1v2.13.5v2.14.0v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1v2.7.0v2.7.1v2.7.2v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.9.0v3.0.0v3.0.1v3.0.2v3.1.0v3.10.0v3.11.0v3.11.1v3.12.0v3.12.0-rc.1v3.12.0-rc.2v3.12.2v3.12.2-rc.1v3.12.2-rc.5v3.2.0v3.2.1v3.2.2v3.3.0v3.3.1v3.4.0v3.5.0v3.6.0v3.7.0v3.7.1v3.7.2v3.7.3v3.8.0v3.8.1v3.8.3v3.9.0v4.0.0v4.0.0-rc.2v4.0.0-rc.3v4.0.0-rc.4v4.0.0-rc.5v4.0.1v4.0.1-rc.1v4.0.2v4.0.2-rc.1v4.1.0v4.1.0-rc.2v4.1.0-rc.3v4.1.1v4.1.1-rc.1v4.1.1-rc.2v4.1.2v4.1.2-rc.2v4.2.0v4.2.0-rc.1v4.2.0-rc.2v4.3.0v4.3.0-rc.1v4.4.0v4.4.0-rc.1v4.4.1v4.4.2v4.5.0v4.5.0-rc.1v4.5.2v4.6.0v4.6.0-rc.1v4.6.0-rc.2v4.6.1

Fixed in

4.6.2

References

https://nvd.nist.gov/vuln/detail/CVE-2024-33670
https://github.com/passbolt/passbolt_api/commit/5c537849040990086dcd5013b5bb009e1dad3fb6
https://help.passbolt.com/incidents/reflective-html-injection-vulnerability

Updated Apr 26, 2024 · Source: OSV.dev
CVE-2017-1000442 GHSA-j2fp-9wp5-mg66 May 14, 2022

Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar

5.4 / 10
Medium
Network Low Low Required Changed Low Low None

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

Affected versions

v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0

+ 11 more Show less

v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.2v1.6.3v1.6.4

Fixed in

1.6.5

References

https://nvd.nist.gov/vuln/detail/CVE-2017-1000442
https://github.com/passbolt/passbolt_api/commit/f5eb93485a90195439e12aa8072f45ceb37b19c3
https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/CVE-2017-1000442.yaml
https://github.com/passbolt/passbolt_api
https://www.passbolt.com/incidents/20170914_xss_on_resource_urls
https://www.passbolt.com/release/notes#September

Updated May 19, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 4
minor 59
patch 73
pre 38

175 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More