Changelog Relution – Relution Customer Hub

Relution 27.0.3

2026-11-04T00:00:00+01:00

Docker Image Index Digest → sha256:709810e0b8d467e1acdebc081fd1ebd7a58670117e3b2c45b95c12bca01e3481

Updates

Apply security and hardening improvements

Relution 27.0.2

2026-10-30T00:00:00+01:00

Docker Image Index Digest → sha256:f44c085f1ffae3d9c10c3c5b053002e4fdd198205a0b7cf9f9327e06ea08ab7f

Updates

Enable text rendering for wallpapers. A re-apply of the policy may be needed [REL-14429]
Apply security and hardening improvements

Fixes

Adjust automatic deployment of the companion and agent on Android to be executed in silent mode, if possible [REL-14799]
Renew expiring identity certificates of Windows devices that do not renew them themselves [REL-14727]

Relution 27.0.1

2026-10-28T00:00:00+01:00

Docker Image Index Digest → sha256:674abb9bcdcdf6d67f3192b66acc918e71aa468fea57139552ae84b998646c33

Fixes

Apply important security fixes and hardening improvements

Relution 26.5.8

2026-10-26T00:00:00+01:00

Docker Image Index Digest → sha256:0fa85ad2ccce7f2f9e20d2c59f0c3336252d677bff3c10f59145bd06d7e7aa3e

Fixes

Apply important security fixes and hardening improvements

Relution 26.5.7

2026-10-23T00:00:00+02:00

Docker Image Index Digest → sha256:7695f4b340aa6f327a4ae9932570b9e4b540d7e071dfa9f758450ecda2051877

Fixes

Apply important security fixes and hardening improvements

Relution 26.5.6

2026-10-22T00:00:00+02:00

Docker Image Index Digest → sha256:6e85d46434906289ea9ca1e2cdd77aa64aad7a9a554e913fe56eadbea8762997

Fixes

Apply important security fixes and hardening improvements

Relution 26.5.5

2026-10-21T00:00:00+02:00

Docker Image Index Digest → sha256:22630f4b1d619973803ede15a83e024a5ab8dd38a1c77e33b983f202b8c19b4a

Updates

Enforce an expiration date for API access tokens (default: one month), the expiration date can no longer be extended [REL-14462]
Expire existing API access tokens without an expiration date 30 days after the update for security reasons. They need to be rotated if still needed [REL-14462]

Fixes

Apply important security fixes and hardening improvements

Relution 26.5.4

2026-10-20T00:00:00+02:00

Docker Image Index Digest → sha256:da8bb64194b73166a5029f7103916a19f803ae0c61cf4b41fdacd8f6b8255397

Fixes

Fix Auth Bypass, see security advisories [RVD-2026-6]

Relution 26.5.3

2026-10-16T00:00:00+02:00

Docker Image Index Digest → sha256:95a27460ceffd7f749af40dbaff24f6ceaff8287c03e02dadc587813869b43d9

Fixes

Fix Permission Issue, see security advisories [RVD-2026-2]
Fix Code Execution, see security advisories [RVD-2026-3]
Fix Database Access Vulnerability, see security advisories [RVD-2026-4]

Relution 26.5.2

2026-10-01T00:00:00+02:00

Docker Image Index Digest → sha256:2540c15fbc64ddf494ad72dbeb4a50cfc3bf718ce6ce760f087a6da9e1764f9a

Fixes

Fix Brute-Force Vulnerability, see security advisories [REL-13800] [RVD-2026-5]
Adjust template resolver configuration [REL-13910]
Prevent upload of files without organization scope [REL-13913]

Relution 26.5.1

2026-09-24T00:00:00+02:00

Docker Image Index Digest → sha256:d3a65793ffded9266de84da021b451a1e7d2437f1f16f48a23f6ee7353838708

New

Remove invalid RSA key size from Apple SCEP configuration [REL-13552]
Restrict RSA key sizes to 3072 and 4096 [REL-13551]

Updates

Allow restricting outbound TSFI TLS connections to a whitelist [REL-13073]
Optimize performance when using different types of access tokens [REL-13558]

Relution 26.5.0

2026-09-15T00:00:00+02:00

Docker Image Index Digest → sha256:d12eb74081fe3d91cb561c36467bab983bc480677dc8ea69858bb5fbc14f5bad

New

Add a sticky header to the login history table [REL-13425]
Add a Verify Recovery Lock action for macOS devices [REL-12537]
Add Autofill Option to Android Enterprise Restrictions to control the behaviour for the build in function. [REL-12213]
Add enhanced retry and backoff handling for object storage operations [REL-11912]
Add option to enforce the minimum OS version during DEP enrollment [REL-12746]
Add placeholders for user certificates [REL-13109]
Add separate authorities for the different access token types [REL-11610]
Add support for certificate pinning during enrollment for apple devices [REL-12744]
Add support to upload multiple user certificates for a subtype [REL-12989]
Add the missing legacy widgets to the new default dashboard [REL-5902]
Add the push method to the Android device details [REL-12980]
Adjust matching of authorized devices to API scopes [REL-13006]
Allow creating sub organizations below an existing meta organization in the wizard [REL-11985]
Allow disconnecting from Android Enterprise while preserving devices instead of wiping them [REL-9082]
App licenses bound to a device are automatically released when the device is deleted from the inventory. [REL-11834]
Apply the Relution UI design to the dashboard [REL-12855]
Ask for confirmation before deleting a dashboard widget [REL-13432]
Assign every endpoint to an API scope [REL-13088]
Certificate is installed when decon policy is applied on a Windows device [REL-9421]
Enable enrollment of Newline whiteboards [REL-13317]
Enable enrolment of VS whiteboards [REL-13318]
Fix the button order in the dashboard dialogs [REL-13448]
Fix the standby and sleep timer on Promethean boards [REL-13022]
Harden action message population against incompletely loaded entities [REL-12066]
Improve device history localization by storing translation keys and translating entries when read [REL-12067]
Improve VPP user handling when accounts are moved between organizations [REL-64]
Keep installed apps when migrating a device from another MDM [REL-12442]
Make API access token scope aware [REL-13019]
Make JWT and login endpoints API scope aware [REL-13005]
Move the Android Enterprise Companion endpoints to a dedicated API scope [REL-11954]
Move the self service endpoints to the selfService API scope [REL-6905]
Obfuscate WNS credentials [REL-12820]
Only allow access to endpoints of enabled API scopes [REL-5555]
Preserve the audit fields of nested entities on update [REL-12593]
Relution can now act as its own OpenID Connect / OAuth2 Identity Provider — register client applications directly in Relution and let users sign in with their existing Relution account across all of them [REL-13113]
Repair the Android Enterprise connection by repeating the signup process [REL-9078]
Rework dashboard to allow creating custom widgets [REL-8093]
Rework the user profile view [REL-13180]
Scope dashboard widget filter definitions per entity and authorization [REL-5905]
Serve the decon endpoints under a dedicated API scope [REL-11957]
Set default to power save mode 1 when eco mode is off on ViewSonic Boards [REL-13117]
Show a dedicated page when the requested login method is not available [REL-13171]
Show the meta badge in all relevant places [REL-11983]
Support SSE-C encryption for the S3 resource storage [REL-11913]
Unify and translate the sub-action failure messages of Apple and Windows [REL-12069]
Use consistent naming for the meta organization in the organization list and details [REL-13464]

Updates

Add a numerical error code to eSIM action errors [REL-12567]
Add dedicated enrollment API scope [REL-13004]
Add Education device groups to provide complex MDM operations during a lesson [REL-12031]
Add MCP tools for policies and settings [REL-11938]
Add support of certificate pools as PKI source [REL-13444]
Add support of Meta Organizations [REL-13372]
Allow navigating from a widget to the filtered entity list [REL-5906]
Allow restricting outbound TSFI TLS connections to a whitelist [REL-13073]
Choose the organization type (standalone, meta or sub) when creating an organization [REL-11949]
Compact the default dashboard layouts and reduce the columns of the keystores widget [REL-12805]
Dialogs for CA certificate selection now only show CA certificates [REL-12863]
Entra ID sign in with OIDC is possible when oid is set as the username attribute [REL-13015]
Fix generated images not being uploaded to S3 [REL-13159]
Fix inconsistent policy status on devices [REL-9629]
Fix the organization scoping of device base info queries [REL-11952]
Fix the parent app link status not being rolled back when sending the email fails [REL-12597]
Fix the password configuration not updating correctly and clarify its wording [REL-13286]
Fix the spacing of the count element in the device group actions tab [REL-13477]
Fix Windows Exchange configuration changes having no effect; the Exchange user name can no longer be edited [REL-2005]
Generate certificates in a dedicated thread pool and create KME capabilities as fallback [REL-11909]
Hide the scope tab bar when registration on live is active [REL-13389]
Isolate the SchulConneX education sync per organization and raise the request timeout [REL-12715]
Log aborted client connections as warning instead of error [REL-13095]
Migrate the compliance history UUID columns from varchar to uuid [REL-12988]
Normalize the base64 output of user certificate placeholders and expose the PKCS#12 password [REL-13456]
Optimize automatic refresh of device action list [REL-12233]
Polish the empty, loading and no-permission states of dashboard widgets [REL-12017]
Poll the Apple Event Status through a dedicated client and skip expired tokens [REL-11832]
Provide option to import weblinks via CSV in the teacher console [REL-12025]
Reduce the maximum HTTP header size to 64 KB [REL-13094]
Renew Apple push certificates, valid until July 2027. The previous ones will expire in January 2027 [REL-12488]
Require a dedicated authority for device group actions [REL-11643]
Serve management and content downloads to device tokens through dedicated device-scoped endpoints [REL-13374]
Show devices of all organizations in the policy details of the global organization [REL-1932]
Show the expiration date of parent app links only for the states Open and Invited [REL-12586]
Support configuring external URL per API scope [REL-13087]
Support editing icons of winget apps [REL-8118]
Support Relution Decon on macOS devices [REL-13055]
Support the current Android API levels and icon sizes when parsing APKs [REL-13046]
Support using a key file for SSE-C encrypted object storage [REL-12853]
Use the external URL for SMTP EHLO/HELO and group the email configuration into sections [REL-13070]
Validate the package name format in detection rule forms [REL-12575]

Fixes

Add a Microsoft account policy to block creation and login of Microsoft accounts on Windows [REL-5840]
Add important security improvement addressing authorization issue affecting authenticated users [REL-13078]
Add important security improvement addressing authorization issue affecting authenticated users [REL-13085]
Add important security improvement addressing authorization issue affecting authenticated users [REL-13092]
Add the missing platforms to the policy prioritization dialog [REL-13269]
Adjust the ActivPanel PIN configuration [REL-13319]
Adjust the column size of dashboard widgets to the available space [REL-13513]
Allow clearing the default StrongSwan VPN profile in StrongSwan restrictions [REL-7232]
Allow previewing a widget before entering its name [REL-13378]
Allow selecting native apps for the remove app action [REL-12978]
Attach server CA certificates with the type AUTHORITY instead of inline PEM fields [REL-12830]
Base VPP asset and assignment clean-up on the assignments received from Apple [REL-11371]
Center the widget states in the widget body [REL-13105]
Clean up compliance violations for platforms that only communicate via the companion app [REL-12974]
Clear stale dynamic device group memberships on re-enrollment [REL-12612]
Close the remote session dialog and report the error on unhandled error codes [REL-11203]
Correct the German translation of the parent app link status Open [REL-13483]
Disallow uninstalling apps that are managed by a Android Enterprise policy [REL-11373]
Do not deliver media actions while a device is awaiting its configuration [REL-13072]
Do not log aborted client requests as errors [REL-13039]
Do not offer user certificates in the certificate selection of policies [REL-13271]
Do not request the user list while a device is awaiting its configuration [REL-12777]
Fall back to the defaults when a removed section of the KSP configuration is reset [REL-13299]
Fix a MariaDB deadlock when updating VPP asset counts [REL-11018]
Fix a race condition where the work queue reported itself idle during completion [REL-13048]
Fix a redirect loop that prevented a second login in the WebView [REL-13345]
Fix an out of memory error when uploading an Android APK [REL-13481]
Fix automatic disassociation of VPP users, when a user change event has been triggered [REL-12984]
Fix creation of compliance history entries in various cases [REL-12843]
Fix duplicate key violation when storing VPP notification entries [REL-5679]
Fix heartbeat requiring extra management endpoint configuration or otherwise blocking server start [REL-13309]
Fix icon alignment on several places [REL-12214]
Fix iOS wallpaper configurations not respecting the configuration priority [REL-6223]
Fix misleading percentage rounding in dashboard widget legends [REL-13459]
Fix the always empty installed apps list of the remove app action [REL-13446]
Fix the bug reporter when removing the metric filter of a widget [REL-13172]
Fix the CSV import class assignment when multiple users share the same class [REL-12837]
Fix the dashboard failing when impersonating another administrator [REL-13183]
Fix the displayed user name and tenant in the portal header [REL-12288]
Fix the initial focus in the user and profile view [REL-13098]
Fix the layout of the policy priority dialog [REL-13439]
Fix the layout of the printed enrollment QR code [REL-11726]
Fix the overflowing organization type column [REL-13454]
Fix the policy filter of the dashboard widgets [REL-13369]
Fix the sizing behaviour of the dashboard widget legend [REL-13445]
Fix the tooltip hints of the Android Enterprise managed app install types [REL-11457]
Fix the unresolved placeholder in the policy version tooltip [REL-13467]
Fix the user and group domain search by marking browsable security providers [REL-12378]
Fix uninstallation of Windows Classic native apps [REL-13438]
Fix visibility of SMG service url field [REL-12993]
Fix VPP user invitations not registering the user [REL-8449]
Handle non-JSON VPP error responses without logging a stacktrace [REL-11406]
Harden the OneRoster token renewal during long running synchronizations [REL-12473]
Hide system apps in the installed apps list of the remove app action [REL-13038]
Hide system groups in organizations management settings from the selection, so that the prefilling during organization creation can’t fail anymore because of invalid prefilled groups [REL-13472]
Hide the empty toolbar on read-only dashboards [REL-13426]
Honour the trusted TLS CA certificates for all outbound connections [REL-13380]
Improve the layout and wording of the create widget dialog [REL-13457]
Improve the UX of the dashboard widget modals [REL-13104]
Link DEP certificates and private keys to their owner [REL-13040]
Load the metric filter into the form when editing a widget [REL-12741]
Make the audit columns of security roles non-nullable and insert-only [REL-12400]
Make the columns of table widgets resizable and horizontally scrollable [REL-12770]
Make the companion signing key certificate fingerprints configurable and skip stale APK deployments [REL-12379]
Make the KSP and system certificate widgets resizable [REL-13114]
Make VPP assignment synchronization idempotent to avoid duplicate assignments [REL-11231]
Map all Apple platforms to the Apple external app store [REL-13024]
Map Windows Pro for Workstations to the PRO OS edition [REL-13053]
Offer the Update MDM profile action for Apple user enrolled devices [REL-13238]
Prevent changes to provider-managed groups for provider-managed users [REL-13033]
Prevent uploading a native app while it is in archive state [REL-1201]
Refuse stale education configuration writes [REL-13081]
Remove outdated policy related compliance violations [REL-12970]
Remove the stray dot behind the selector in the associate license dialog [REL-13458]
Remove the unused ChromeOS specific scope and the obsolete server CA PEM fields [REL-12055]
Removed unsupported EAP Phase 2 authentication types from the Android Enterprise Wi-Fi configuration [REL-12776]
Report more specific error messages when user certificates are missing on Apple and Windows devices [REL-11739]
Report the UUID of the existing user in CSV import skip messages [REL-13042]
Require a confirmation before deleting a user certificate [REL-12737]
Reset the enrollment cycle on re-enrollment and Return to Service [REL-12992]
Respect the JVM proxy settings and apply a connect timeout during the OIDC token exchange [REL-13391]
Respect the policy version state filter in dashboard widgets [REL-13227]
Revoke the JWT token when logging out from any client [REL-13365]
Show a validation message for the host in the Windows Exchange configuration [REL-13452]
Show the app name of removable apps [REL-13025]
Show the correct info page when a user denies the consent during the IdP login [REL-12806]
Show the export progress and fix crashes when exporting large device lists [REL-12002]
Show the no-permission state in custom dashboard widgets [REL-13103]
Skip device group locking when the memberships are unchanged [REL-13057]
Skip externally managed courses during the CSV import [REL-12931]
Stop logging an error for every revoked certificate during the certificate migration [REL-13388]
Stop the nightly resource migration from rewriting unchanged files [REL-13268]
Validate the SSE-C encryption configuration to prevent misconfiguration [REL-13449]

Relution 26.4.6

2026-09-07T00:00:00+02:00

Docker Image Index Digest → sha256:97b707b3345eedeb3c662fb5cf3511a842d1a13efd563e947193f5c466ed16fc

Fixes

Ensure that apps from a global VPP token are also preserved when the “Preserve all existing apps” option is active in the DEP profile [REL-13320]

Relution 26.4.5

2026-08-19T00:00:00+02:00

Docker Image Index Digest → sha256:43623a30af74aa3f717995103b0b9fcf5714e84119a97c7338bacdf33c74302d

Fixes

Fix persisting the push token of Android Classic devices [REL-13243]

Relution 26.4.4

2026-08-18T00:00:00+02:00

Docker Image Index Digest → sha256:0f409d9970135fa541d8b7c397eed3808f31bee058d9b594d4122a9cb5b4c22f

Updates

Augment “preserve all apps” functionality for Apple device migration [REL-13167]

Fixes

Prevent loss of ON-Demand App Installation for Apps iOS 26 device migration [REL-12442]
Improve caching of Image Render Service [REL-13159]

Relution 26.4.3

2026-08-12T00:00:00+02:00

Docker Image Index Digest → sha256:e7741d980fdbfae25dc14b5f479ad1fb26991c01a4f44e39d6fa4d0a32828318

New

Add support to upload multiple user certificates for a subtype [REL-12989]
Add new “Managed software updates” configuration for apple devices [REL-12745]
Add support for ECDSA keys to certificate templates and Apple IKEv2 VPN configuration [REL-11898]

Updates

Dialogs for CA certificate selection shows only CA certificates [REL-12863]

Fixes

Fix an issue where a lifetime licensed device cannot be re-enrolled after migration to another organization [REL-13026]
Fix an issue where a lifetime licensed device cannot be enrolled when the device license metric of the organization is exceeded [REL-12471]

Relution 26.4.2

2026-08-11T00:00:00+02:00

Docker Image Index Digest → sha256:f3b9a6b0a270abddf205581b930e80c8844866f59da6a6609bc5fc37a71a8b1f

Fixes

Add important security improvement addressing authorization issue affecting authenticated users [REL-13078] [REL-13085] [REL-13086] [REL-13092] [RVD-2026-1]

Relution 26.4.1

2026-07-30T00:00:00+02:00

Fixes

Fix automatic disassociation of VPP users, when a user change event has been triggered [REL-12984]
Fix visibility of SMG service url field [REL-12993]
Fix creation of compliance history entries in various cases [REL-12843]

Relution 26.4.0

2026-07-16T00:00:00+02:00

With Relution 26.4.0, the internal application server was switched from Undertow to Tomcat. If the reverse proxy runs on a different server than Relution itself, logging in may subsequently fail with the message Access is forbidden (TLS required in the server log). In this case, the configuration must be adjusted according to the steps described in Login: Access is forbidden →

New

Improve self-service portal device locate flow so authorised users can access location feedback [REL-11014]
Add shutdown action support for Newline smartboards [REL-10615]
Add time zone information to Apple device details [REL-12447]
Add enhanced retry and backoff handling for object storage operations [REL-11912]
Improve foundation of object storage and general resource storage handling with better resilience and observability [REL-11910]
Improve object storage client connection handling and timeout configuration [REL-11911]
Improve device history localization by storing translation keys and translating entries when read [REL-12067]
Add support for DEP enrollment using username and enrollment code authentication [REL-11841]
Add support for managing additional CA certificates in global settings for outbound SSL/TLS connections [REL-11453]
Add server version to audit log start and stop entries [REL-12423]
Improve organization switcher to pin specific items [REL-11748]
Introduce scoped OIDC redirect URIs for reverse-proxy path gating. Legacy URI stays valid but is deprecated, register the new URIs at your Identity Provider, check Relution Hub for more information [REL-10832]
Add support for automatically updating the assigned device user when a user logs into a managed Windows device, with organization-level and device-level controls [REL-8313]
Extend agent-scope API support by mirroring relevant server endpoints and migrating Relution Assets to use only endpoints from its dedicated API scope [REL-10523]
Add search bar to Apple and Android app compliance lists to make apps easier to find [REL-12023]

Updates

Exclude obsolete Relution client certificates from key store checks and cleaned up leftover database entries [REL-11535]
Update Spring Boot to Version 4 [REL-10462]
Disable audit logs for get actions management endpoint by default [REL-12475]
Support pinning the TLS certificate for Apple Software Update lookup service (GDMF) requests [REL-11344]
Adjust handling of VPP apps being reported with zero licenses [REL-10792]
Improve reliability of macOS VPP app update detection and installation [REL-11659]
Improve SSO failure log messages with more useful context for troubleshooting [REL-12286]
Improve handling of expired Apple VPP tokens by validating token expiry before associate/disassociate actions and reducing unnecessary error logging [REL-463]
Add support for the macOS security action “Set Recovery Lock” on supervised and managed devices [REL-11630]
Improve database performance for VPP assignment and app lookup operations by adding missing indices [REL-1744]
Add a warning log when Apple TokenUpdate messages are received without a push token [REL-12068]
Change embedded web server from Undertow to Tomcat [REL-11894]
Add “Unspecified” option for Android Enterprise configurations [REL-11881]
Add collapsible placeholders in configuration editors to improve usability for large forms [REL-11933]
Do not show empty description and changelog sections for native app versions [REL-12175]
Improve readability of compliance violation details by making non-compliant reasons easier to view in Poral [REL-7443]
Improve DEP account wizard by fixing duplicate loading indicators and disabling “Cancel” during account setup [REL-12110]
Improve native iOS app details view so the URL Schemes section is shown correctly and aligned consistently [REL-12126]
Change AE settings user interface into a tab-based layout [REL-10589]

Fixes

Fix missing file size information for native apps in required apps lists [REL-12141]
Fix Shared iPads not automatically receiving Educational Configuration after reset and re-enrollment [REL-12510]
Fix validation and error messaging for Windows Firewall configurations [REL-11482]
Fix searching for large numbers of device serial numbers at once [REL-11855]
Fix Windows Firewall policy deployment for firewall rules that reference apps [REL-12430]
Fix support of per-app VPN connection in iOS email configuration [REL-12429]
Fix an issue on multi node setups that lead to ObjectAlreadyExistsExceptions (DashboardNotificationPullJob) [REL-12428]
Avoid applying changes to users and classes when a OneRoster or ASM sync fetch is incomplete [REL-12412]
Fix an issue with certain instances that are reporting empty metrics due to a cache initialization issue [REL-12358]
Fix an issue where providing an own APNS Certificate via global did not get propagated properly to other organizations [REL-12370]
Fix an issue where android enterprise sim card details did not get updated properly [REL-12315]
Display Decon block page also on Android Enterprise devices [REL-12202]
Fix creation of audit log entry for specific events from a device [REL-12217]
Fix PKG app detection rule dialog showing the wrong rule form when no rule type was selected [REL-12453]
Fix iOS Web Clip URL validation to allow custom app protocol handlers and placeholders [REL-12432]
Fix download link for native app downloads via Portal on iOS/iPadOS devices [REL-12323]

Relution 26.3.3

2026-07-01T00:00:00+02:00

Updates

Exclude obsolete Relution client certificates from key store checks and clean up leftover database entries [REL-11535]

Fixes

Fix an issue with lifetime licenses to provide license claims during license handshake in case the status of the corresponding device has changed [REL-12538]
Fix an issue that prevented certain organizations from performing a license handshake in case certificates of different key sizes where present on the same instance [REL-12481]