What's Fixed in TeamForge 26.0?

In addition to addressing several security vulnerabilities, the following issues were fixed in TeamForge 26.0.

General Fixes

• Fixed an issue where TeamForge was unable to relay emails through SMTP servers requiring STARTTLS. The Apache James Mail Server has been upgraded to version 3.9.0, which includes STARTTLS support. Email relay now correctly supports STARTTLS for secure TLS-based SMTP communication.

• Fixed an issue where searching for users on the User-Role Matrix page returned no results after upgrading. User searches now display matching results correctly, consistent with the User List page.

• Fixed an issue where long artifact titles in My Workspace were truncated without displaying the full title on hover. Full artifact titles are now available through a tooltip when the displayed title is truncated.

• Fixed an issue where Burn Down custom reports failed to load and returned a 500 Internal Server Error. Burn Down reports now generate and display correctly in the Custom Report View.

• Fixed an issue where changing an artifact from one tracker to another could result in a Page Not Found or System Error when the trackers contained different field configurations. Tracker changes now complete successfully, including scenarios involving required, dependent, or deleted fields.

• Fixed an issue where changing an artifact from one tracker to another could result in a Page Not Found or System Error when the target tracker contained required or dependent fields. Tracker changes now complete successfully in these scenarios.

• Fixed a UI issue where only parts of the Favorite icon in the artifact edit slider were clickable. The entire icon is now clickable, making it easier to mark and unmark items as favorites.

• Fixed a performance issue where the Planning Folder REST API could return a 504 Gateway Timeout when retrieving artifacts from planning folders containing a large number of artifacts. The API has been optimized to improve response times for large planning folders.

Security Fixes

• Fixed an improper access control issue where unauthenticated users could access Gerrit account detail endpoints and retrieve user information. Access to these endpoints is now restricted to authorized users, preventing unauthorized disclosure of account details.

• Fixed a security issue where insufficient input validation could allow malicious content to be uploaded and rendered in the application. User-supplied input is now validated and sanitized to prevent unsafe content from being processed.

• Fixed a security issue where insufficient input validation could allow HTML injection and stored cross-site scripting (XSS) attacks. User-supplied input is now validated, sanitized, and safely encoded to prevent malicious content from being rendered or executed.

• Strengthened input validation and output encoding to prevent malicious content from being uploaded or rendered, mitigating the risk of cross-site scripting (XSS) and other injection-based attacks.

• Implemented multiple security enhancements based on grey box testing findings, including stronger input validation, improved Content Security Policy (CSP) enforcement, CAPTCHA support for applicable workflows, and enhanced session management to further protect against common web application attacks.

• Implemented security enhancements to address multiple findings identified during grey box testing, including improved input validation, stronger Content Security Policy (CSP) enforcement, CAPTCHA protection for applicable workflows, and enhanced session management controls to strengthen application security.

• Upgraded Apache Tomcat from version 11.0.14 to 11.0.18 to address CVE-2026-34500, an authentication bypass vulnerability affecting CLIENT_CERT authentication when using the Forwarded/Front-End mechanism (FFM).

• Upgraded the bundled Apache Tomcat version to address multiple security vulnerabilities, including issues affecting authentication, security constraint enforcement, HTTP/2 request validation, WebSocket authentication, WebDAV request handling, and AJP secret validation.

TeamForge SCM Fixes

• Fixed an issue where users could not push to protected branches after a Git repository was moved to another project, despite having the required permissions. Gerrit permissions are now refreshed correctly after a repository move, ensuring protected branch access is applied as expected.

• Fixed an issue where users could not push to protected branches after a Git repository was moved to another project. Protected branch permissions are now refreshed correctly after a repository move, ensuring users with the required permissions can perform Git push and merge operations as expected.

• Fixed an issue where Git merge operations could fail after moving a repository to another project when protected branches were configured. Merge permissions are now refreshed correctly after a repository move, ensuring eligible users can merge code reviews without requiring protected branch settings to be reconfigured.

• Fixed an issue where Git commits referencing multiple artifact IDs could bypass Open for SCM validation if at least one referenced artifact was eligible for SCM association. Commit validation now checks all referenced artifacts and rejects the commit if any artifact does not meet the required Open for SCM criteria.

• Fixed an issue where the Fast-Forward Only submit policy for Git repositories was not preserved during upgrades and migrations. Repository submit type settings are now retained correctly, eliminating the need to manually reconfigure repository policies after migration.

• Fixed an issue where the Fast-Forward Only Git repository submit policy was not preserved during migration or upgrade. Repository submit type settings are now retained correctly after migration, eliminating the need for manual reconfiguration.

• Fixed an issue where the Submit Type setting for Git repositories could not be changed from the inherited option. Repository submit type changes are now saved and applied correctly.

• Fixed an issue where text could not be selected or copied from the left diff pane in the TeamForge-integrated Gerrit review UI. Text selection and copying now work consistently across both diff panes.

• Fixed an issue where artifact IDs referenced in Gerrit review commit messages were no longer displayed as clickable association links. Artifact associations are now rendered correctly, allowing users to navigate directly to the associated artifacts.

• Fixed an issue where downloading certain files from SVN repositories through the TeamForge Code Browser resulted in a 500 Internal Server Error. SVN file downloads now complete successfully for affected repositories.

• Fixed an issue where downloading certain SVN repository files from the Code Browser resulted in a 500 Internal Server Error. SVN files now download successfully regardless of file metadata or response header size.

Provisioning and System Fixes

• Fixed an issue that could prevent JBoss from starting successfully after upgrade due to a database inconsistency that resulted in a non-unique query result. The application now handles this scenario correctly, preventing the server from entering a doomed state.