Released June 2026
What's new?
Suspend/resume customer accounts: MSP admins can now suspend and resume customer accounts. When suspended, accounts are locked from making changes; spam and virus filtering is disabled; Link Lock is disabled; and scheduled and quarantine reports are stopped. Only parent admins can resume accounts, restoring full access and previous filter settings. See Suspend/Resume Customers for more information.
UI/UX updates:
We have added an
Inheritedcolumn to the DMARC bypass list at the MSP level to show system-inherited exceptions.The User and Domain Policy tables now contain a geoblocking policy status column, making it easy to see at a glance which users or domains have geoblocking enabled or disabled. Geoblocking can now also be toggled directly from the policy add/edit view.
Bug fixes, performance improvements and UI improvements
Updated the LinkLock module to use
encode_base64urlfor URL-safe Base64 encoding when processing link rewriting data. This ensures proper encoding of compressed URL metadata (customer ID, domain, mail ID, sender, recipient, and encoded URL) for secure transmission through the Link Lock analysis service. The change improves URL data handling consistency and security in email link rewriting operations.The LDAP sync script now properly filters out email addresses with
ccmail:andms:prefixes during Active Directory synchronization, preventing these non-standard email formats from being imported into the system.Fixed multiple issues preventing scheduled reports from being sent.
Resolved an issue where .xlsx files were incorrectly being classified as .xlsm files. Added proper file-type mappings for Microsoft Excel 2007+, Excel, OpenDocument Spreadsheet, and Microsoft OOXML formats to the amavisd configuration to ensure accurate file type detection.
Resolved an issue where mail authentication was still being executed when SASLAUTH was being used. The Auth handler has been added to the milter configuration to properly handle SASL authentication.
Added validation to enforce a maximum length of 255 characters for domain names in the domain management API. Domains exceeding this limit will now be rejected with a validation error.
Resolved a race condition that could occur when simultaneously creating accounts and antispoof settings. The fix adds proper exception handling for unique constraint violations, ensuring graceful error responses instead of unhandled exceptions.
Fixed an issue where broader IP ranges were incorrectly rejected when more specific ranges were already configured at higher levels. The validation logic now properly allows broader ranges in this configuration scenario.
Fixed an issue where users were unable to delete pattern filters.
Resolved potential permissions error after password reset: Users who reset their password via the forgot-password flow could receive a
Route not founderror when subsequently trying to view quarantine messages.
Security fixes and hardening improvements
Security hardening:
Fixed CSRF issue with file uploader: Fixed a cross-site request forgery (CSRF) vulnerability in the file uploader.
CSRF cookie security enhancement: Improved CSRF token cookie security by implementing secure cookie attributes including
Secure,HttpOnly, andSameSite=Strictflags on authentication pages.Security headers applied to all responses: Enhanced security by ensuring that X-Content-Type-Options, X-Frame-Options, and X-XSS-Protection headers are sent on all HTTP responses, including error responses. Fixed X-Frame-Options directive from 'append' to 'set' to prevent duplicate headers, and properly quoted the Set-Cookie header edit directive to handle semicolons correctly.
Fixed null byte character vulnerability: Fixed a security vulnerability where null byte characters in date input fields could bypass validation and cause exceptions. Added enhanced input validation to reject date fields containing null bytes across API endpoints for authentication, reporting, history trace, quarantine, and scan summary statistics.
Security updates:
Package updates: Upgraded FreeBSD packages with known vulnerabilities.