CVE-2026-111497

Fixed.

CVE

CVE-2026-93990

Fixed

CVE

CVE-2026-77214

Fixed

CVE

CVE-2026-76957

Fixed

CVE

CVE-2026-76956

Fixed

CVE

CVE-2026-75140 - NOT REACHABLE

Fixed

CVE

CVE-2026-66046

Fixed

CVE

CVE-2023-54404 - NOT REACHABLE

Fixed

CVE

Saving does not clear the redo history

Saving now also clears the redo history, so changes from before the save can no longer be re-applied.

Bug

Complicated export filename in case export dialog is suppressed

Fixed an issue where the export filename fallback was not working as intended.
The export name format is now consistently <date>_<name> where name is the first elements name in the export branch.

Bug

CronJob to clean orphaned large objects | PostgreSQL

Introduced a cleanup job to remove orphaned large objects to reclaim disk space.Enabling it is recommended for all PostgreSQL installations.See the https://levigo.github.io/output-organizer-documentation/operations/housekeeping/postgresql-large-objects

Task

Correct error message for protected documents

Export dialog shows the correct error message on failure

Task

Cleanup mechanism for annotation profile registry (Signature annotations)

The signature settings belonging to a collection are now only held for as long as the collection is open in the viewer. Once the last viewer using them is closed, they are removed automatically.Signatures stay available the whole time you are working with the documents. At the same time, the server no longer builds up unused data over its runtime.

Task

Alphabetic import order of documents imported from filesystem

When multiple documents are uploaded to Output Organizer, they are sorted alphabetically by name.

Task

Limiting collection deletion job with maxDurationInHours

Added a maxDurationInHours for the deletion job

organizer:
    jobs:
      deletion:
        ...
        maxDurationInHours: 1 # Maximum runtime of a single run

Task

Process automated collection deletion in batches

Process collection deletion in batches & improve performance

Story

Endpoint protection / endpoint cleanup

Several previously unprotected endpoints are now fully authenticated in case OAuth is enabled.Some non-public endpoints were moved to “internal” subpath; also some ununsed endpoints were removed.Customers who use the Swagger UI or scrape actuator/Prometheus endpoints with actuator credentials configured may need to adjust their setup. The Swagger UI is no longer available, and actuator endpoints require basic auth unless prometheus.anonymousAccess is enabled for /actuator/prometheus.

Story

CVE-2026-91777

Fixed

CVE

CVE-2026-91776

Fixed

CVE

CVE-2026-89425

Fixed

CVE

CVE-2026-89407

Fixed

CVE

CVE-2026-8763

Fixed

CVE

CVE-2026-68497

Fixed

CVE

CVE-2026-13506

Fixed

CVE

CVE-2026-101896

Fixed

CVE

Collection deletion does not continue when a document is gone

Collection cleanup is continued even if the document is not present

Bug

Expose management port in Kubernetes

An application management port set in Helm now automatically exposes that port with an attached Kubernetes service.
This affects organizer.managementPort, viewer.managementPort, controller.managementPort and topdf.managementPort.

Bug

Editing right after opening a collection can get lost

Editing can begin immediately after loading a collection, and no edits will be lost.

Bug

Dragging over a parent node doesn’t expand it

Fixed behaviour to improve UX

Bug

PostgreSQL driver regression

Rolled back to org.postgresql:postgresql:42.7.12.

Bug

CVE-2026-58059

Fixed

CVE

CVE-2026-14682

Fixed

CVE

CVE-2026-13506

Fixed

CVE