CVE-2026-111497

Fixed.

CVE

CVE-2026-93990

Fixed

CVE

CVE-2026-77214

Fixed

CVE

CVE-2026-76957

Fixed

CVE

CVE-2026-76956

Fixed

CVE

CVE-2026-75140 - NOT REACHABLE

Fixed

CVE

CVE-2026-66046

Fixed

CVE

CVE-2026-111497

Fixed

CVE

CVE-2023-54404 - NOT REACHABLE

Fixed

CVE

JWT viewer shows an empty viewer after switching between empty combined views

Switching between filtered views no longer leaves the viewer empty and views with documents always show their pages again.

Bug

View selection dropdown clips text hard instead of showing ellipsis

View descriptions that are too long to fit are now beautifully truncated with an ellipsis.

Bug

Saving does not clear the redo history

Saving now also clears the redo history, so changes from before the save can no longer be re-applied.

Bug

Complicated export filename in case export dialog is suppressed

Fixed an issue where the export filename fallback was not working as intended.
The export name format is now consistently <date>_<name> where name is the first elements name in the export branch.

Bug

Close the multi-element tag editor with Escape

The tag editor for multiple elements can now be closed with the Escape key like all other dialogs

Bug

CronJob to clean orphaned large objects | PostgreSQL

Introduced a cleanup job to remove orphaned large objects to reclaim disk space.Enabling it is recommended for all PostgreSQL installations.See the ⁠PostgreSQL large objects documentation

Task

Limiting PVC document cleanup with maxDurationInHours

Added a maxDurationInHours for the pvc cleanup job:

organizer:
  jobs:
    pvcDocumentCleanup:
      ...
      maxDurationInHours: 1       # Maximum runtime of a single run

Task

Limiting collection deletion job with maxDurationInHours

Added a maxDurationInHours for the deletion job

organizer:
    jobs:
      deletion:
        ...
        maxDurationInHours: 1 # Maximum runtime of a single run

Task

Improve History compaction performance

Indexing the column version_timestamp in the Table CollectionHistoryEntity to improve the performance of history compaction service

Task

Expose PVC document cleanup deletionBatchSize

added deletionBatchSize to pvcDocumentCleanup

organizer:
  jobs:
    pvcDocumentCleanup:
      ...
      deletionBatchSize: 100

Task

Process automated collection deletion in batches

Process collection deletion in batches & improve performance

Story

Endpoint protection / endpoint cleanup

Several previously unprotected endpoints are now fully authenticated in case OAuth is enabled.Some non-public endpoints were moved to “internal” subpath; also some ununsed endpoints were removed.Customers who use the Swagger UI or scrape actuator/Prometheus endpoints with actuator credentials configured may need to adjust their setup. The Swagger UI is no longer available, and actuator endpoints require basic auth unless prometheus.anonymousAccess is enabled for /actuator/prometheus.

Story

CVE-2026-91777

Fixed

CVE

CVE-2026-91776

Fixed

CVE

CVE-2026-89425

Fixed

CVE

CVE-2026-89407

Fixed

CVE

CVE-2026-68497

Fixed

CVE

CVE-2026-58059

Fixed

CVE

CVE-2026-14682

Fixed

CVE

CVE-2026-13506

Fixed

CVE

CVE-2026-101896

Fixed

CVE

PostgreSQL driver regression

Rolled back to org.postgresql:postgresql:42.7.12.

Bug

Discarded changes still there right after "Discard"

Discarding changes fully reloads the collection.

Bug

Overlapping seen-state saves fail

Seen markers are stored reliably, however fast users move through a collection.

Bug

Expose management port in Kubernetes

An application management port set in Helm now automatically exposes that port with an attached Kubernetes service.
This affects organizer.managementPort, viewer.managementPort, controller.managementPort and topdf.managementPort.

Bug

Edits made right after acquiring write permission a collection are silently lost

Edits aren’t lost if made immediately after acquiring the lock.

Bug

Editing right after opening a collection can get lost

Editing can begin immediately after loading a collection, and no edits will be lost.

Bug

Editing metadata of single document is not undoable

Individual document metadata edits can now be undone again

Bug

Dragging over a parent node doesn’t expand it

Fixed behaviour to improve UX

Bug

Document not loading after restoring old version (continuous view only)

After loading a version from history, viewer displays the collection correctly in continuous view.

Bug

Viewer renders adaptively by default (device-pixel-ratio)

The viewer now always adapts its rendering resolution to the user's screen. On standard displays, high-resolution (HiDPI / Retina) displays, and at higher browser zoom levels alike, documents are shown sharp out of the box — no configuration required.
The viewer.qualityEnhancement setting has therefore been removed.
See:
https://levigo.github.io/dossier-organizer-documentation/installation/deployment/#jadice-web-viewer-viewer

Task

Add HPA Support

Components can now scale automatically based on configured resource utilization thresholds. See https://levigo.github.io/dossier-organizer-documentation/installation/scaling

Task

k8s gateway API for Fusion

Added the possibility to setup a Gateway API `HTTPRoute`https://levigo.github.io/dossier-organizer-documentation/installation/installation/#gateway-api-httproute

Story

GHSA-r7wm-3cxj-wff9

Fixed.

CVE

CVE-2026-69151

Fixed.

CVE

CVE-2026-68945

Fixed.

CVE

CVE-2026-59901

Fixed.

CVE

CVE-2026-56819

Fixed.

CVE

CVE-2026-56816

Fixed.

CVE

CVE-2026-56745

Fixed.

CVE

CVE-2026-55833

Fixed.

CVE

CVE-2026-55831

Fixed.

CVE

CVE-2026-54513

Fixed.

CVE

CVE-2026-54512

Fixed.

CVE

CVE-2026-54291

Fixed.

CVE

CVE-2026-54268

Fixed

CVE

CVE-2026-54267

Fixed

CVE

CVE-2026-54266

Fixed

CVE

CVE-2026-50010

Fixed.

CVE

CVE-2026-48748

Fixed.

CVE

CVE-2026-47691

Fixed.

CVE

CVE-2026-45674

Fixed.

CVE

CVE-2026-45416

Fixed.

CVE

CVE-2026-44894

Fixed.

CVE

CVE-2026-44892

Fixed.

CVE

CVE-2026-44249

Fixed.

CVE

CVE-2026-41850 / NVD High 7,5

Fixed

CVE

CVE-2026-41007 / NVD High 7.5

Fixed

CVE

CVE-2026-40984 / NVD High 7,5

Fixed

CVE

CVE-2026-40983 / NVD High 7,5

Fixed

CVE

CVE-2025-59375

Fixed.

CVE

Policy rule evaluation ignores DENY precedence for core actions

Policy evaluation for actions now correctly applies DENY precedence, ensuring that a matching DENY rule overrides any ALLOW rule regardless of rule order. Please ensure that your defined rules are not affected by this change.

Bug

Missing session ID check on tile URLs

Restored functionality to check the session ID before serving document tile images.

Bug

Text annotations are rotated after export

Text annotation rotation property was added to the default annotation profile and should now be properly applied to the export result.

Bug

Sometimes no documents available after loading historic version

Viewer display the next available document when loading a collection from the history.

Bug

Latest updated element can’t be marked as unseen

An error with calculating the modification date was fixed, that occurred when saving the collection during a session and changing the seen status manually afterwards.

Bug

History dialogs "own" filter fails in some cases

Made the filter for own versions in the history dialog more robust.

Bug

Exporting fails when tree is empty

Export button gets disabled when there are no documents available to export.

Bug

"100% Zoom" does not match real size

Default resolution was set to 96 DPI instead of 72 DPI to better match the original size.

Bug

Support user token claims in conditions

Added functionality to the Access Policies that allow the integrator to define claim specific conditions.
For this the prefix `principal.claim:` can be used to extract information from the authentication token. The syntax is the same as the already existing claim selector in the subject field of access policies and defines a path in the token data.See https://levigo.github.io/dossier-organizer-documentation/model/conditions/

Task

PVC File Storage Cleanup

Files left after export will be automatically deleted.
See: https://levigo.github.io/dossier-organizer-documentation/operations/housekeeping/automated-deletion

Task

Irritating message when opening collection without "update" rights

Collection.UPDATE is respected by the application and reflects the state of the collection

Task

Authenticated download for export result

When authentication is enabled the export result link is protected by the configured authentication.Because of this many of the options included in the export UI dialog were not usable without technical knowledge and are now only available when the authentication is disabled.To compensate for this, we added a new option to download the document with the current user authentication.

Task

First applied rule overrules all following definitions in Access Policies on Client Side

Fixed a client side problem for disabling or enabling UI elements based on Access Policies.

Bug

Some custom translations not working any more

Fixed a path collision that was causing customized translations to be overwritten

Bug

True and False conditions have wrong syntax in documentation

Fixed documentation for true and false conditions.

Bug

global.extraEnvVars does not affect viewer deployment

Added missing {{extraEnvVars}}to viewer deployment. Configuration via {{global.extraEnvVars}}now work properly for the {{organizer }}and {{viewer }}pods, as described in the documentation.

Bug

Export Notification message in DO documentation is wrong

The export notification format was updated:
https://levigo.github.io/dossier-organizer-documentation/integration/export-notifications

Bug

Changed default config on EH-Cache

Reversed accidentally changed default option for the Helm Value storage.ehcache.enabled to false.

Bug