2.0.0-rc1

What's Changed

Changed

• Replace top navbar with sidebar (#464)
• Check seat count when unarchiving a vault (#432)
• Improved data sync between Keycloak and Hub (#465, #463)
• Improved Emergency Access (#439, #424, #440, #442, #454, #425)
• Simplify Helm Chart (#456)
• Improved audit log query efficiency (#466)
• Cosmetic UI improvements (#437)

Misc

• Bumped to Java 25 and Quarkus 3.33 (#469)
• Updated dependencies (#460, #471, #434, #433, #455, #449, #462)
• Migrated to constructor injection and added jspecify annotations (#470)
• Migrated to pnpm (#446, #459)
• Added new DB base migration (#467, #468)
• Added OpenTelemetry support (#443)
• Updated translations (#438, #472)

Full Changelog: 1.5.0-beta4...2.0.0-rc1

1.5.0-beta4

Note

The linked Security Advisories will be published within the next days

What's Changed

• Fixed Emergency Access Authorization Bypass
• Fixed Unauthorized Read/Delete of Recovery Process State
• Fixed Endpoints Accepts Invalid / non-JWE Key Material

All instances must be updated as soon as possible to address this security vulnerability.

Full Changelog: 1.5.0-beta3...1.5.0-beta4

1.5.0-beta3

What's Changed

• Update Quarkus to 3.27.3.1 to address the authentication and authorisation bypass vulnerability (CVE-2026-39852)

All instances must be updated as soon as possible to address this security vulnerability.

Full Changelog: 1.5.0-beta2...1.5.0-beta3

1.4.7

What's Changed

• Update dependencies, primarily Quarkus, to version 3.20.6.1 to address the authentication and authorisation bypass vulnerability (CVE-2026-39852).

All instances must be updated as soon as possible to address this security vulnerability.

Full Changelog: 1.4.6...1.4.7

1.5.0-beta2

What's Changed

Added

• Allow admins to archive and unarchive any vault (#283, #430)
• Disable users to exclude them from license seat count (#427, #428)
• Display a banner to indicate that legacy devices are still in use, since these will be removed in the next major release (#420)

Fixed

• Creating user with sole role create-vault was unable to login due to missing role user

Full Changelog: 1.5.0-beta1...1.5.0-beta2

1.5.0-beta1

Happy Birthday, Cryptomator! 🎉

Today, Cryptomator Turns 10. What once began as a small idea has become a tool trusted by millions of people worldwide to keep their data private in an increasingly connected world.

What's Changed

Added

• User and group management (#376)
• Emergency Access: Allow a council to restore access to a orphaned vault (#390)
• Show pictures of the groups in the Vaults member list (#375)
• Added helm chart

Changed

• Updated Keycloak to 26.5.4
• Update Quarkus to 3.27.2 LTS
• Improved browser locale detection (#371)
• Improved efficiency of keycloak-to-hub data sync (#377)
• Improved efficiency of group-based access permission checks (#372)
• Migrated aes-siv and base encoding libraries to @noble/ciphers and @scure/base (#373)
• Move health check to separate service port (see Required actions for the 1.5.0-beta1 Update for further information)

Security

• CVE-2025-64756, CVE-2025-64118: removed glob and tar dependencies
• CVE-2025-64718, CVE-2025-62522: updated js-yaml and `vite

Required actions for the 1.5.0-beta1 Update

We highly recommend updating Keycloak to version 26.4.1.

The default health check port changed from 8080 to 9000, please consider this change during update:

Docker Compose:

    healthcheck:
      test:
        - CMD-SHELL
---        - (curl -f http://localhost:8080/q/health/live && curl -f http://localhost:8080/api/config) || exit 1
+++        - (curl -f http://localhost:9000/q/health/live && curl -f http://localhost:8080/api/config) || exit 1
      interval: 10s
      timeout: 3s

Kubernetes:

          startupProbe:
            httpGet:
              path: /q/health/started
---           port: 8080
+++           port: 9000
          ...
          readinessProbe:
            httpGet:
              path: /api/config
---           port: 8080
+++           port: 9000
            initialDelaySeconds: 10
            periodSeconds: 3

Full Changelog: 1.4.6...1.5.0-beta1

1.4.6

What's Changed

• Show admin section of Hub when Keycloak version is not available (#361)
• Updated Keycloak to 26.4.1
• Updated to Quarkus 3.20.3 LTS

Recommended actions for the 1.4.6 Update

We highly recommend updating Keycloak to version 26.4.1.

You can skip this step if you created your realm with script version 8 or above. If not:

Keycloak starting in version 26.4.0 does not expose it's version by default to non-master realm admins. To be able to see the version of Keycloak again in Hub, please execute the following:

1. Open Keycloak
2. Select Clients
3. Select realm-management
4. In Roles create a role with the name view-system
5. Select the cryptomatorhub-system client
6. Under Service Account Role assign the created view-system client role to this client

Now you can wait until the cryptomatorhub-system refreshes its token or you restart Hub (by default within a few minutes), then you will see again the Keycloak version e.g. in the Admin section of Hub.

Full Changelog: 1.4.5...1.4.6

1.4.5

What's Changed

• Fix Session Expiration Not Enforced in Cryptomator Hub Web Client (GHSA-69fp-wc9g-5778)

All instances must be updated as soon as possible to address a security vulnerability.

Full Changelog: 1.4.4...1.4.5

1.4.4

What's Changed

• Added Breadcrumb Navigation #345
• Added unsaved changes notice with undo in the WOT settings #346
• Added support for regionalized translations #350
• Added Latvian, Portuguese (Brazil), Russian, Ukrainian and Chinese (Taiwan) translation #350
• Updated Keycloak to 26.3.2
• Updated to Quarkus 3.20.2 LTS

Full Changelog: 1.4.3...1.4.4

1.4.3

What's Changed

• Fix health check in Docker Compose by adding curl to native images (#344)
• Bump dependencies

Full Changelog: 1.4.2...1.4.3