All feeds – Relution Customer Hub

Relution Shield 26.3.1

Wed, 04 Nov 2026 00:00:00 +0100

Updates

Connections without EAP or XAuth authentication are rejected. The device ID is determined exclusively from the EAP identity and no longer from the IKE identity. The example configurations for iOS and Android Enterprise use EAP and are not affected
Device IDs are checked against a fixed format before the access check (4 to 64 characters, letters, digits, - and _); other IDs are rejected
New environment variable ACCESS_CHECK_FAIL_OPEN (default true) defines whether devices with a valid certificate are accepted when their status cannot be determined. It replaces RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE; the previous name is still evaluated as long as ACCESS_CHECK_FAIL_OPEN is not set
New environment variable DEVICE_COMPLIANCE_DIR for the directory inside the container in which the compliance status is cached (default /opt/strongswan/compliance)
Control characters are removed from the peer identities before they are written to the log
Security improvements and hardening

Fixes

A response from the Relution server that cannot be evaluated, such as a proxy error page, is treated like an unreachable server and follows the ACCESS_CHECK_FAIL_OPEN setting
If the compliance status cannot be cached, the result returned by the Relution server still applies

Version 26.3.0 was not released on Docker Hub; its changes are included in 26.3.1.

Relution 27.0.3

Wed, 04 Nov 2026 00:00:00 +0100

Docker Image Index Digest → sha256:709810e0b8d467e1acdebc081fd1ebd7a58670117e3b2c45b95c12bca01e3481

Updates

Apply security and hardening improvements

Relution 27.0.2: Current

Fri, 30 Oct 2026 17:35:50 +0100

Released on 30 October 2026

Available under the latest tag: Relution on Docker Hub →.
Details in the Changelog →.

Next version: Planned

Fri, 30 Oct 2026 17:35:50 +0100

Date to be announced

Planned

Apps and Books: very high license counts for purchased apps

Fri, 30 Oct 2026 00:00:00 +0100

Apple has changed the licensing model for Apps and Books (VPP in the portal): apps are no longer purchased in a fixed quantity but are assigned to a location without a count. For such apps, Apple reports the technical maximum value 2147483647 as the license count. Relution takes over Apple’s values unchanged, so values such as 2147483647 appear under Purchased Apps in the Licenses and Available columns.

The value means that the licenses for the app are not limited. Assignment to devices and users works as usual; the Used column still shows the number of licenses actually assigned.

Relution 27.0.2

Fri, 30 Oct 2026 00:00:00 +0100

Docker Image Index Digest → sha256:f44c085f1ffae3d9c10c3c5b053002e4fdd198205a0b7cf9f9327e06ea08ab7f

Updates

Enable text rendering for wallpapers. A re-apply of the policy may be needed [REL-14429]
Apply security and hardening improvements

Fixes

Adjust automatic deployment of the companion and agent on Android to be executed in silent mode, if possible [REL-14799]
Renew expiring identity certificates of Windows devices that do not renew them themselves [REL-14727]

live.relution.io: Operational

Thu, 29 Oct 2026 15:32:44 +0100

Fully available again. Sending emails has been working again since Thursday, 29 October 2026, 14:00 CET.

Database update fails when updating from 26.0.x to 26.1 or later (MariaDB)

Thu, 29 Oct 2026 00:00:00 +0100

When updating from Relution 26.0.x to 26.1 or later, the automatic database update can fail with the error message Cannot change column 'action_uuid': used in a foreign key constraint. MariaDB versions 10.11.5–10.11.7 are affected (known MariaDB issue).

Cause and solution: Known error messages for database updates →

Linux: installation directory writable for the Relution service

Wed, 28 Oct 2026 00:00:00 +0100

As of Relution 26.5.8, the Relution server checks on startup whether the installation directory is writable for the user the service runs as. This affects Linux installations without Docker where /opt/relution is entirely owned by the service user relution, for example after chown -R relution:relution /opt/relution. For each affected directory, the Relution server log shows an ERROR message that starts as follows:

Installation path /opt/relution/portal is writable for the user running Relution.

The server still starts and continues to work normally. The message indicates file permissions that are too broad. On Windows, the check is not performed.

Solution: The installation directory is owned by root. Only the log/ and branding/ directories remain writable for the service user relution, and application.yml remains readable for it. For an installation under /opt/relution, the permissions are set as follows:

sudo systemctl stop relution
sudo chown -R root:root /opt/relution
sudo chmod -R u=rwX,go=rX /opt/relution
sudo mkdir -p /opt/relution/log /opt/relution/branding
sudo chown -R relution:relution /opt/relution/log /opt/relution/branding
sudo chown root:relution /opt/relution/application.yml && sudo chmod 640 /opt/relution/application.yml
sudo systemctl start relution

After the restart, the message no longer appears.

Relution 27.0.1

Wed, 28 Oct 2026 00:00:00 +0100

Docker Image Index Digest → sha256:674abb9bcdcdf6d67f3192b66acc918e71aa468fea57139552ae84b998646c33

Fixes

Apply important security fixes and hardening improvements

helpdesk.relution.io: Operational

Mon, 26 Oct 2026 11:12:07 +0100

Back online from Monday, 26 October 2026, 12:00 CET, and available daily from 9:00 to 17:00 CET. Outside these hours, you can reach us by email as usual at helpdesk@relution.io →.

SaaS instances: Operational

Mon, 26 Oct 2026 11:12:07 +0100

Fully reachable again without restrictions from Monday, 26 October 2026, 12:00 CET.

Relution 26.5.8

Mon, 26 Oct 2026 00:00:00 +0100

Docker Image Index Digest → sha256:0fa85ad2ccce7f2f9e20d2c59f0c3336252d677bff3c10f59145bd06d7e7aa3e

Fixes

Apply important security fixes and hardening improvements

license.relution.io: Limited

Fri, 23 Oct 2026 16:20:48 +0200

Currently not reachable for partners.

Apple TV Remote: new bundle ID as of iOS 27

Fri, 23 Oct 2026 00:00:00 +0200

With iOS 27, Apple provides the Apple TV Remote app as a standalone app in the App Store. It uses the new bundle ID com.apple.TVRemoteApp. Relution’s list of iOS system apps (as of 27.0.1) still contains the app under its previous bundle ID com.apple.TVRemote. If Apple TV Remote is added from the system app selection in the App compliance policy configuration, the entry therefore does not apply to the new app.

Effects on devices running iOS 27 or later:

If Apple TV Remote is listed under Allowed apps, the new app is hidden nonetheless.
If Apple TV Remote is listed under Blocked apps, the new app remains usable nonetheless.

Workaround: The bundle ID com.apple.TVRemoteApp is added to the respective list as well, either via the Apple TV Remote app imported from the App Store (Manage App Store apps →) or by entering the bundle ID manually. The previous entry can remain in place. Since Relution does not treat the new app as a system app, it can be distributed via Required apps like any other App Store app.

More information: App compliance →

Relution 26.5.7

Fri, 23 Oct 2026 00:00:00 +0200

Docker Image Index Digest → sha256:7695f4b340aa6f327a4ae9932570b9e4b540d7e071dfa9f758450ecda2051877

Fixes

Apply important security fixes and hardening improvements

Secure Mail Gateway 26.0.7

Thu, 22 Oct 2026 00:00:00 +0200

Breaking change with SMG 26.0.7: From SMG version 26.0.7, the Secure Mail Gateway requires additional configuration when the Exchange server is reachable using a private IP address range (RFC 1918 →). See Forwarding to private IP addresses →

Fixes

Important security fixes and hardening improvements [REL-14324]
Breaking change with SMG 26.0.7: The Secure Mail Gateway requires additional configuration when the Exchange server is reachable using a private IP address range (RFC 1918 →) [REL-14327]

PHP2Shell (CVE-2026-109618, CVE-2026-109619): Relution not affected

Thu, 22 Oct 2026 00:00:00 +0200

The critical vulnerabilities in the PHP core published in October 2026 (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) do not affect Relution. Relution server, Relution portal and Secure Mail Gateway contain no PHP and do not use a PHP interpreter; the services are based on Java.

No action is therefore required for Relution. Other applications using PHP that run on the same server or in the upstream reverse proxy must be checked independently of Relution and updated according to the PHP project’s guidance.

SMG: access token expires 30 days after updating to 26.5.5

Thu, 22 Oct 2026 00:00:00 +0200

As of Relution 26.5.5, API access tokens always have an expiration date. Existing tokens without an expiration date expire 30 days after the update; they cannot be extended. This also applies to the access token the Secure Mail Gateway (SMG) uses to authenticate against the Relution server if it was created without an expiration date. Once it has expired, the Relution server rejects the token and the Relution server log shows the following message:

AccessTokenService: AccessToken verification failed, the token is expired

As of Relution 26.5.8, the Relution server answers requests with an expired token with HTTP status 401 and the error code ACCESS_TOKEN_EXPIRED; previously it answered with 500. The log message remains unchanged.

PostgreSQL with Relution 26.5.5 or 26.5.6: With a PostgreSQL database, existing tokens without an expiration date did not expire 30 days after the update to 26.5.5 or 26.5.6 but immediately. As of Relution 26.5.7, these tokens correctly receive a remaining lifetime of 30 days during the update. Tokens that have already expired remain expired and are replaced as described below.

Solution: Within 30 days of the update (immediately if the token has already expired), a new access token with the usage API and the API scope Secure Mail Gateway (smg) is created for the SMG’s technical user in the global organization. The expiration date is only set on creation and cannot be changed afterwards. On creation, the Expiration Date is preset to today plus 30 days and can be set to a later date, as of Relution 27.0.1 up to the latest possible expiration date shown in the dialog (by default 1 year after creation); the Limited time of use switch is no longer available for API tokens. A new token is created before each expiry (Create a technical user and access token →). The new token replaces the previous value of api-key in smg/application.yaml. The SMG container is then restarted so that the changed configuration is loaded:

docker compose restart smg

If the new token lacks the API scope Secure Mail Gateway (smg), the Relution server rejects the SMG’s requests with HTTP status 403.

More information: REST API →

Relution 26.5.6

Thu, 22 Oct 2026 00:00:00 +0200

Docker Image Index Digest → sha256:6e85d46434906289ea9ca1e2cdd77aa64aad7a9a554e913fe56eadbea8762997

Fixes

Apply important security fixes and hardening improvements

hub.relution.io: Operational

Wed, 21 Oct 2026 16:56:35 +0200

Operational

idea.relution.io: Shut down

Wed, 21 Oct 2026 16:56:35 +0200

Shut down

community.relution.io: Shut down

Wed, 21 Oct 2026 16:56:35 +0200

Shut down

Relution 26.5.5

Wed, 21 Oct 2026 00:00:00 +0200

Docker Image Index Digest → sha256:22630f4b1d619973803ede15a83e024a5ab8dd38a1c77e33b983f202b8c19b4a

Updates

Enforce an expiration date for API access tokens (default: one month), the expiration date can no longer be extended [REL-14462]
Expire existing API access tokens without an expiration date 30 days after the update for security reasons. They need to be rotated if still needed [REL-14462]

Fixes

Apply important security fixes and hardening improvements

Relution 26.5.4

Tue, 20 Oct 2026 00:00:00 +0200

Docker Image Index Digest → sha256:da8bb64194b73166a5029f7103916a19f803ae0c61cf4b41fdacd8f6b8255397

Fixes

Fix Auth Bypass, see security advisories [RVD-2026-6]

Relution 26.5.3

Fri, 16 Oct 2026 00:00:00 +0200

Docker Image Index Digest → sha256:95a27460ceffd7f749af40dbaff24f6ceaff8287c03e02dadc587813869b43d9

Fixes

Fix Permission Issue, see security advisories [RVD-2026-2]
Fix Code Execution, see security advisories [RVD-2026-3]
Fix Database Access Vulnerability, see security advisories [RVD-2026-4]

Relution 26.5.2

Thu, 01 Oct 2026 00:00:00 +0200

Docker Image Index Digest → sha256:2540c15fbc64ddf494ad72dbeb4a50cfc3bf718ce6ce760f087a6da9e1764f9a

Fixes

Fix Brute-Force Vulnerability, see security advisories [REL-13800] [RVD-2026-5]
Adjust template resolver configuration [REL-13910]
Prevent upload of files without organization scope [REL-13913]

Exchange policy: No user certificate of subtype Exchange

Wed, 30 Sep 2026 00:00:00 +0200

When a policy with an Exchange configuration is applied, the Change policy action fails in the device actions. The following message is displayed:

At least one sub action failed: ErrorCode: -, Message: No user certificate of subtype Exchange found for user <username>.

The cause is the Use user certificate setting in the Certificate section of the Exchange configuration. With this option, Relution looks for a user certificate of subtype Exchange for the device user. If no such certificate exists for the user, the account cannot be deployed.

Solution: In the applied Exchange configuration, the Select certificate option is set in the Certificate section. No certificate needs to be selected; the configuration can be saved directly.

The same applies to the S/MIME certificates further down in the Exchange configuration. If S/MIME signing or encryption is enabled, the S/MIME signing certificate and S/MIME encryption certificate sections appear there with the same choice. If one of these sections is set to Use user certificate, Relution additionally looks for a user certificate of subtype S/MIME signing or S/MIME encryption, and the action fails with the corresponding message if none exists. In this case, the Select certificate option is set in these sections as well.

More information: Exchange →

Relution 26.5.1

Thu, 24 Sep 2026 00:00:00 +0200

Docker Image Index Digest → sha256:d3a65793ffded9266de84da021b451a1e7d2437f1f16f48a23f6ee7353838708

New

Remove invalid RSA key size from Apple SCEP configuration [REL-13552]
Restrict RSA key sizes to 3072 and 4096 [REL-13551]

Updates

Allow restricting outbound TSFI TLS connections to a whitelist [REL-13073]
Optimize performance when using different types of access tokens [REL-13558]

Secure Mail Gateway 26.0.6

Thu, 17 Sep 2026 00:00:00 +0200

Fixes

Incoming HTTP headers are now correctly treated as case-insensitive in all cases, which avoids potentially duplicated headers in the forwarded request [REL-13556]

Relution 26.5.0

Tue, 15 Sep 2026 00:00:00 +0200

Docker Image Index Digest → sha256:d12eb74081fe3d91cb561c36467bab983bc480677dc8ea69858bb5fbc14f5bad

New

Add a sticky header to the login history table [REL-13425]
Add a Verify Recovery Lock action for macOS devices [REL-12537]
Add Autofill Option to Android Enterprise Restrictions to control the behaviour for the build in function. [REL-12213]
Add enhanced retry and backoff handling for object storage operations [REL-11912]
Add option to enforce the minimum OS version during DEP enrollment [REL-12746]
Add placeholders for user certificates [REL-13109]
Add separate authorities for the different access token types [REL-11610]
Add support for certificate pinning during enrollment for apple devices [REL-12744]
Add support to upload multiple user certificates for a subtype [REL-12989]
Add the missing legacy widgets to the new default dashboard [REL-5902]
Add the push method to the Android device details [REL-12980]
Adjust matching of authorized devices to API scopes [REL-13006]
Allow creating sub organizations below an existing meta organization in the wizard [REL-11985]
Allow disconnecting from Android Enterprise while preserving devices instead of wiping them [REL-9082]
App licenses bound to a device are automatically released when the device is deleted from the inventory. [REL-11834]
Apply the Relution UI design to the dashboard [REL-12855]
Ask for confirmation before deleting a dashboard widget [REL-13432]
Assign every endpoint to an API scope [REL-13088]
Certificate is installed when decon policy is applied on a Windows device [REL-9421]
Enable enrollment of Newline whiteboards [REL-13317]
Enable enrolment of VS whiteboards [REL-13318]
Fix the button order in the dashboard dialogs [REL-13448]
Fix the standby and sleep timer on Promethean boards [REL-13022]
Harden action message population against incompletely loaded entities [REL-12066]
Improve device history localization by storing translation keys and translating entries when read [REL-12067]
Improve VPP user handling when accounts are moved between organizations [REL-64]
Keep installed apps when migrating a device from another MDM [REL-12442]
Make API access token scope aware [REL-13019]
Make JWT and login endpoints API scope aware [REL-13005]
Move the Android Enterprise Companion endpoints to a dedicated API scope [REL-11954]
Move the self service endpoints to the selfService API scope [REL-6905]
Obfuscate WNS credentials [REL-12820]
Only allow access to endpoints of enabled API scopes [REL-5555]
Preserve the audit fields of nested entities on update [REL-12593]
Relution can now act as its own OpenID Connect / OAuth2 Identity Provider — register client applications directly in Relution and let users sign in with their existing Relution account across all of them [REL-13113]
Repair the Android Enterprise connection by repeating the signup process [REL-9078]
Rework dashboard to allow creating custom widgets [REL-8093]
Rework the user profile view [REL-13180]
Scope dashboard widget filter definitions per entity and authorization [REL-5905]
Serve the decon endpoints under a dedicated API scope [REL-11957]
Set default to power save mode 1 when eco mode is off on ViewSonic Boards [REL-13117]
Show a dedicated page when the requested login method is not available [REL-13171]
Show the meta badge in all relevant places [REL-11983]
Support SSE-C encryption for the S3 resource storage [REL-11913]
Unify and translate the sub-action failure messages of Apple and Windows [REL-12069]
Use consistent naming for the meta organization in the organization list and details [REL-13464]

Updates

Add a numerical error code to eSIM action errors [REL-12567]
Add dedicated enrollment API scope [REL-13004]
Add Education device groups to provide complex MDM operations during a lesson [REL-12031]
Add MCP tools for policies and settings [REL-11938]
Add support of certificate pools as PKI source [REL-13444]
Add support of Meta Organizations [REL-13372]
Allow navigating from a widget to the filtered entity list [REL-5906]
Allow restricting outbound TSFI TLS connections to a whitelist [REL-13073]
Choose the organization type (standalone, meta or sub) when creating an organization [REL-11949]
Compact the default dashboard layouts and reduce the columns of the keystores widget [REL-12805]
Dialogs for CA certificate selection now only show CA certificates [REL-12863]
Entra ID sign in with OIDC is possible when oid is set as the username attribute [REL-13015]
Fix generated images not being uploaded to S3 [REL-13159]
Fix inconsistent policy status on devices [REL-9629]
Fix the organization scoping of device base info queries [REL-11952]
Fix the parent app link status not being rolled back when sending the email fails [REL-12597]
Fix the password configuration not updating correctly and clarify its wording [REL-13286]
Fix the spacing of the count element in the device group actions tab [REL-13477]
Fix Windows Exchange configuration changes having no effect; the Exchange user name can no longer be edited [REL-2005]
Generate certificates in a dedicated thread pool and create KME capabilities as fallback [REL-11909]
Hide the scope tab bar when registration on live is active [REL-13389]
Isolate the SchulConneX education sync per organization and raise the request timeout [REL-12715]
Log aborted client connections as warning instead of error [REL-13095]
Migrate the compliance history UUID columns from varchar to uuid [REL-12988]
Normalize the base64 output of user certificate placeholders and expose the PKCS#12 password [REL-13456]
Optimize automatic refresh of device action list [REL-12233]
Polish the empty, loading and no-permission states of dashboard widgets [REL-12017]
Poll the Apple Event Status through a dedicated client and skip expired tokens [REL-11832]
Provide option to import weblinks via CSV in the teacher console [REL-12025]
Reduce the maximum HTTP header size to 64 KB [REL-13094]
Renew Apple push certificates, valid until July 2027. The previous ones will expire in January 2027 [REL-12488]
Require a dedicated authority for device group actions [REL-11643]
Serve management and content downloads to device tokens through dedicated device-scoped endpoints [REL-13374]
Show devices of all organizations in the policy details of the global organization [REL-1932]
Show the expiration date of parent app links only for the states Open and Invited [REL-12586]
Support configuring external URL per API scope [REL-13087]
Support editing icons of winget apps [REL-8118]
Support Relution Decon on macOS devices [REL-13055]
Support the current Android API levels and icon sizes when parsing APKs [REL-13046]
Support using a key file for SSE-C encrypted object storage [REL-12853]
Use the external URL for SMTP EHLO/HELO and group the email configuration into sections [REL-13070]
Validate the package name format in detection rule forms [REL-12575]

Fixes

Add a Microsoft account policy to block creation and login of Microsoft accounts on Windows [REL-5840]
Add important security improvement addressing authorization issue affecting authenticated users [REL-13078]
Add important security improvement addressing authorization issue affecting authenticated users [REL-13085]
Add important security improvement addressing authorization issue affecting authenticated users [REL-13092]
Add the missing platforms to the policy prioritization dialog [REL-13269]
Adjust the ActivPanel PIN configuration [REL-13319]
Adjust the column size of dashboard widgets to the available space [REL-13513]
Allow clearing the default StrongSwan VPN profile in StrongSwan restrictions [REL-7232]
Allow previewing a widget before entering its name [REL-13378]
Allow selecting native apps for the remove app action [REL-12978]
Attach server CA certificates with the type AUTHORITY instead of inline PEM fields [REL-12830]
Base VPP asset and assignment clean-up on the assignments received from Apple [REL-11371]
Center the widget states in the widget body [REL-13105]
Clean up compliance violations for platforms that only communicate via the companion app [REL-12974]
Clear stale dynamic device group memberships on re-enrollment [REL-12612]
Close the remote session dialog and report the error on unhandled error codes [REL-11203]
Correct the German translation of the parent app link status Open [REL-13483]
Disallow uninstalling apps that are managed by a Android Enterprise policy [REL-11373]
Do not deliver media actions while a device is awaiting its configuration [REL-13072]
Do not log aborted client requests as errors [REL-13039]
Do not offer user certificates in the certificate selection of policies [REL-13271]
Do not request the user list while a device is awaiting its configuration [REL-12777]
Fall back to the defaults when a removed section of the KSP configuration is reset [REL-13299]
Fix a MariaDB deadlock when updating VPP asset counts [REL-11018]
Fix a race condition where the work queue reported itself idle during completion [REL-13048]
Fix a redirect loop that prevented a second login in the WebView [REL-13345]
Fix an out of memory error when uploading an Android APK [REL-13481]
Fix automatic disassociation of VPP users, when a user change event has been triggered [REL-12984]
Fix creation of compliance history entries in various cases [REL-12843]
Fix duplicate key violation when storing VPP notification entries [REL-5679]
Fix heartbeat requiring extra management endpoint configuration or otherwise blocking server start [REL-13309]
Fix icon alignment on several places [REL-12214]
Fix iOS wallpaper configurations not respecting the configuration priority [REL-6223]
Fix misleading percentage rounding in dashboard widget legends [REL-13459]
Fix the always empty installed apps list of the remove app action [REL-13446]
Fix the bug reporter when removing the metric filter of a widget [REL-13172]
Fix the CSV import class assignment when multiple users share the same class [REL-12837]
Fix the dashboard failing when impersonating another administrator [REL-13183]
Fix the displayed user name and tenant in the portal header [REL-12288]
Fix the initial focus in the user and profile view [REL-13098]
Fix the layout of the policy priority dialog [REL-13439]
Fix the layout of the printed enrollment QR code [REL-11726]
Fix the overflowing organization type column [REL-13454]
Fix the policy filter of the dashboard widgets [REL-13369]
Fix the sizing behaviour of the dashboard widget legend [REL-13445]
Fix the tooltip hints of the Android Enterprise managed app install types [REL-11457]
Fix the unresolved placeholder in the policy version tooltip [REL-13467]
Fix the user and group domain search by marking browsable security providers [REL-12378]
Fix uninstallation of Windows Classic native apps [REL-13438]
Fix visibility of SMG service url field [REL-12993]
Fix VPP user invitations not registering the user [REL-8449]
Handle non-JSON VPP error responses without logging a stacktrace [REL-11406]
Harden the OneRoster token renewal during long running synchronizations [REL-12473]
Hide system apps in the installed apps list of the remove app action [REL-13038]
Hide system groups in organizations management settings from the selection, so that the prefilling during organization creation can’t fail anymore because of invalid prefilled groups [REL-13472]
Hide the empty toolbar on read-only dashboards [REL-13426]
Honour the trusted TLS CA certificates for all outbound connections [REL-13380]
Improve the layout and wording of the create widget dialog [REL-13457]
Improve the UX of the dashboard widget modals [REL-13104]
Link DEP certificates and private keys to their owner [REL-13040]
Load the metric filter into the form when editing a widget [REL-12741]
Make the audit columns of security roles non-nullable and insert-only [REL-12400]
Make the columns of table widgets resizable and horizontally scrollable [REL-12770]
Make the companion signing key certificate fingerprints configurable and skip stale APK deployments [REL-12379]
Make the KSP and system certificate widgets resizable [REL-13114]
Make VPP assignment synchronization idempotent to avoid duplicate assignments [REL-11231]
Map all Apple platforms to the Apple external app store [REL-13024]
Map Windows Pro for Workstations to the PRO OS edition [REL-13053]
Offer the Update MDM profile action for Apple user enrolled devices [REL-13238]
Prevent changes to provider-managed groups for provider-managed users [REL-13033]
Prevent uploading a native app while it is in archive state [REL-1201]
Refuse stale education configuration writes [REL-13081]
Remove outdated policy related compliance violations [REL-12970]
Remove the stray dot behind the selector in the associate license dialog [REL-13458]
Remove the unused ChromeOS specific scope and the obsolete server CA PEM fields [REL-12055]
Removed unsupported EAP Phase 2 authentication types from the Android Enterprise Wi-Fi configuration [REL-12776]
Report more specific error messages when user certificates are missing on Apple and Windows devices [REL-11739]
Report the UUID of the existing user in CSV import skip messages [REL-13042]
Require a confirmation before deleting a user certificate [REL-12737]
Reset the enrollment cycle on re-enrollment and Return to Service [REL-12992]
Respect the JVM proxy settings and apply a connect timeout during the OIDC token exchange [REL-13391]
Respect the policy version state filter in dashboard widgets [REL-13227]
Revoke the JWT token when logging out from any client [REL-13365]
Show a validation message for the host in the Windows Exchange configuration [REL-13452]
Show the app name of removable apps [REL-13025]
Show the correct info page when a user denies the consent during the IdP login [REL-12806]
Show the export progress and fix crashes when exporting large device lists [REL-12002]
Show the no-permission state in custom dashboard widgets [REL-13103]
Skip device group locking when the memberships are unchanged [REL-13057]
Skip externally managed courses during the CSV import [REL-12931]
Stop logging an error for every revoked certificate during the certificate migration [REL-13388]
Stop the nightly resource migration from rewriting unchanged files [REL-13268]
Validate the SSE-C encryption configuration to prevent misconfiguration [REL-13449]

Relution Shield 26.2.0

Tue, 08 Sep 2026 00:00:00 +0200

Updates

The environment variables RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE and DEVICE_STATE_CACHE_DURATION_MINUTES are passed to the access check and take effect as of this version [REL-12795]
Update to strongSwan 6.1.0

Relution 26.4.6

Mon, 07 Sep 2026 00:00:00 +0200

Docker Image Index Digest → sha256:97b707b3345eedeb3c662fb5cf3511a842d1a13efd563e947193f5c466ed16fc

Fixes

Ensure that apps from a global VPP token are also preserved when the “Preserve all existing apps” option is active in the DEP profile [REL-13320]

Shortcuts as a required app

Tue, 01 Sep 2026 00:00:00 +0200

Apple changed the bundle ID of the Shortcuts app. The older Apps and Books listing (VPP in the portal) with the bundle ID is.workflow.my.app can no longer be installed on devices running iOS 26 or later, because iOS actively rejects the installation with the error AppBlacklisted. If this older listing is included in the Required apps list, the deployment keeps restarting without the installation ever completing successfully.

Typical symptoms:

Affected iOS devices are displayed as Noncompliant in the device inventory.
Shortcuts is correctly listed under Installed apps.
The app deployment keeps restarting but never completes successfully.
The device log shows the message This app can no longer be installed on this version of the OS. together with the error code AppBlacklisted.

Workaround: The outdated Apps and Books app with the bundle ID is.workflow.my.app is removed from the Required apps list, and the corresponding Apps and Books assignment is deleted.

The current Shortcuts app with the bundle ID com.apple.shortcuts should not currently be added to the Required apps list as a replacement, since Relution still treats Shortcuts as a system app that cannot be installed. If Shortcuts is genuinely missing on individual devices, it can instead be installed separately by distributing an Apple App Store app (Manage App Store apps →).

Log levels cannot be changed via the system portal

Fri, 28 Aug 2026 00:00:00 +0200

As of Relution 26.4, only the health endpoint is exposed by default for security reasons. The system portal therefore shows the Details section only; the Logger, Environment, Metrics and Threads sections appear once the corresponding endpoints have been enabled in the application.yml. Independently of this, log levels can still be changed via the Web API.

Cause and solution: Enabling the actuator endpoints →

Update hangs at GeneratedSelfSignedSignerKeyStore (Docker)

Thu, 27 Aug 2026 00:00:00 +0200

In Docker installations with an outdated host kernel, the update can hang while generating the self-signed signing certificate (GeneratedSelfSignedSignerKeyStore).

Cause and solution: Known error messages of the Docker installation →

Prometheus metrics are not exposed

Thu, 27 Aug 2026 00:00:00 +0200

As of Relution 26.4, only the health endpoint is exposed by default for security reasons; the Prometheus endpoint (/actuator/prometheus) is disabled. Prometheus monitoring therefore does not receive any metrics until the endpoint has been enabled once in the application.yml.

In addition, as of Relution 26.5.5 the server no longer evaluates basic authentication by default. Prometheus queries of /api/management/actuator/prometheus with user name and password therefore do not receive any metrics either; Prometheus is switched to an API access token.

Cause and solution: Enabling Prometheus metrics in Relution →

Server startup fails with a self-signed S3 certificate

Wed, 26 Aug 2026 00:00:00 +0200

After updating from a version earlier than 26.2 directly to Relution 26.4 or newer, the server no longer starts if the connected S3 object storage is reached over TLS using a self-signed or company-internal certificate. The following error appears in the log:

AccessDeniedException: software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (SDK Attempt Count: 3)

Cause and solution — including the required re-login of all users: S3: Startup fails with PKIX error →

Secure Mail Gateway 26.0.5

Thu, 20 Aug 2026 00:00:00 +0200

New

Show more useful info about custom CA certificates added to the trust store [REL-12991]
Show more useful info when a connection is rejected due to an untrusted server certificate [REL-12991]
Basic HTTP exchange errors are now also visible when using HTTP/2 [REL-13245]

Updates

Native headers strategy is now the default [REL-12991]
Default HTTP post-size limit is now 1 GiB [REL-12991]
Premature transfer completion is now logged [REL-13245]
Log Exchange server’s status response code when a message is rejected [REL-13245]
Logs now show basic activity rather than nothing for successful transfers [REL-13245]

Fixes

The connection of a transfer that terminates prematurely is properly disposed [REL-13245]

Relution 26.4.5

Wed, 19 Aug 2026 00:00:00 +0200

Docker Image Index Digest → sha256:43623a30af74aa3f717995103b0b9fcf5714e84119a97c7338bacdf33c74302d

Fixes

Fix persisting the push token of Android Classic devices [REL-13243]

Relution 26.4.4

Tue, 18 Aug 2026 00:00:00 +0200

Docker Image Index Digest → sha256:0f409d9970135fa541d8b7c397eed3808f31bee058d9b594d4122a9cb5b4c22f

Updates

Augment “preserve all apps” functionality for Apple device migration [REL-13167]

Fixes

Prevent loss of ON-Demand App Installation for Apps iOS 26 device migration [REL-12442]
Improve caching of Image Render Service [REL-13159]

Relution 26.4.3

Wed, 12 Aug 2026 00:00:00 +0200

Docker Image Index Digest → sha256:e7741d980fdbfae25dc14b5f479ad1fb26991c01a4f44e39d6fa4d0a32828318

New

Add support to upload multiple user certificates for a subtype [REL-12989]
Add new “Managed software updates” configuration for apple devices [REL-12745]
Add support for ECDSA keys to certificate templates and Apple IKEv2 VPN configuration [REL-11898]

Updates

Dialogs for CA certificate selection shows only CA certificates [REL-12863]

Fixes

Fix an issue where a lifetime licensed device cannot be re-enrolled after migration to another organization [REL-13026]
Fix an issue where a lifetime licensed device cannot be enrolled when the device license metric of the organization is exceeded [REL-12471]

Relution 26.4.2

Tue, 11 Aug 2026 00:00:00 +0200

Docker Image Index Digest → sha256:f3b9a6b0a270abddf205581b930e80c8844866f59da6a6609bc5fc37a71a8b1f

Fixes

Add important security improvement addressing authorization issue affecting authenticated users [REL-13078] [REL-13085] [REL-13086] [REL-13092] [RVD-2026-1]

Secure Mail Gateway 26.0.4

Tue, 04 Aug 2026 00:00:00 +0200

Updates

Update code style to fix formatting issues when switching between projects [REL-14911]
Update publishing process to docker hub to meet latest security requirements [REL-14912]

Relution 26.4.1

Thu, 30 Jul 2026 00:00:00 +0200

Fixes

Fix automatic disassociation of VPP users, when a user change event has been triggered [REL-12984]
Fix visibility of SMG service url field [REL-12993]
Fix creation of compliance history entries in various cases [REL-12843]

Relution 26.4.0

Thu, 16 Jul 2026 00:00:00 +0200

With Relution 26.4.0, the internal application server was switched from Undertow to Tomcat. If the reverse proxy runs on a different server than Relution itself, logging in may subsequently fail with the message Access is forbidden (TLS required in the server log). In this case, the configuration must be adjusted according to the steps described in Login: Access is forbidden →

New

Improve self-service portal device locate flow so authorised users can access location feedback [REL-11014]
Add shutdown action support for Newline smartboards [REL-10615]
Add time zone information to Apple device details [REL-12447]
Add enhanced retry and backoff handling for object storage operations [REL-11912]
Improve foundation of object storage and general resource storage handling with better resilience and observability [REL-11910]
Improve object storage client connection handling and timeout configuration [REL-11911]
Improve device history localization by storing translation keys and translating entries when read [REL-12067]
Add support for DEP enrollment using username and enrollment code authentication [REL-11841]
Add support for managing additional CA certificates in global settings for outbound SSL/TLS connections [REL-11453]
Add server version to audit log start and stop entries [REL-12423]
Improve organization switcher to pin specific items [REL-11748]
Introduce scoped OIDC redirect URIs for reverse-proxy path gating. Legacy URI stays valid but is deprecated, register the new URIs at the Identity Provider, check Relution Hub for more information [REL-10832]
Add support for automatically updating the assigned device user when a user logs into a managed Windows device, with organization-level and device-level controls [REL-8313]
Extend agent-scope API support by mirroring relevant server endpoints and migrating Relution Assets to use only endpoints from its dedicated API scope [REL-10523]
Add search bar to Apple and Android app compliance lists to make apps easier to find [REL-12023]

Updates

Exclude obsolete Relution client certificates from key store checks and cleaned up leftover database entries [REL-11535]
Update Spring Boot to Version 4 [REL-10462]
Disable audit logs for get actions management endpoint by default [REL-12475]
Support pinning the TLS certificate for Apple Software Update lookup service (GDMF) requests [REL-11344]
Adjust handling of VPP apps being reported with zero licenses [REL-10792]
Improve reliability of macOS VPP app update detection and installation [REL-11659]
Improve SSO failure log messages with more useful context for troubleshooting [REL-12286]
Improve handling of expired Apple VPP tokens by validating token expiry before associate/disassociate actions and reducing unnecessary error logging [REL-463]
Add support for the macOS security action “Set Recovery Lock” on supervised and managed devices [REL-11630]
Improve database performance for VPP assignment and app lookup operations by adding missing indices [REL-1744]
Add a warning log when Apple TokenUpdate messages are received without a push token [REL-12068]
Change embedded web server from Undertow to Tomcat [REL-11894]
Add “Unspecified” option for Android Enterprise configurations [REL-11881]
Add collapsible placeholders in configuration editors to improve usability for large forms [REL-11933]
Do not show empty description and changelog sections for native app versions [REL-12175]
Improve readability of compliance violation details by making non-compliant reasons easier to view in Poral [REL-7443]
Improve DEP account wizard by fixing duplicate loading indicators and disabling “Cancel” during account setup [REL-12110]
Improve native iOS app details view so the URL Schemes section is shown correctly and aligned consistently [REL-12126]
Change AE settings user interface into a tab-based layout [REL-10589]

Fixes

Fix missing file size information for native apps in required apps lists [REL-12141]
Fix Shared iPads not automatically receiving Educational Configuration after reset and re-enrollment [REL-12510]
Fix validation and error messaging for Windows Firewall configurations [REL-11482]
Fix searching for large numbers of device serial numbers at once [REL-11855]
Fix Windows Firewall policy deployment for firewall rules that reference apps [REL-12430]
Fix support of per-app VPN connection in iOS email configuration [REL-12429]
Fix an issue on multi node setups that lead to ObjectAlreadyExistsExceptions (DashboardNotificationPullJob) [REL-12428]
Avoid applying changes to users and classes when a OneRoster or ASM sync fetch is incomplete [REL-12412]
Fix an issue with certain instances that are reporting empty metrics due to a cache initialization issue [REL-12358]
Fix an issue where providing an own APNS Certificate via global did not get propagated properly to other organizations [REL-12370]
Fix an issue where android enterprise sim card details did not get updated properly [REL-12315]
Display Decon block page also on Android Enterprise devices [REL-12202]
Fix creation of audit log entry for specific events from a device [REL-12217]
Fix PKG app detection rule dialog showing the wrong rule form when no rule type was selected [REL-12453]
Fix iOS Web Clip URL validation to allow custom app protocol handlers and placeholders [REL-12432]
Fix download link for native app downloads via Portal on iOS/iPadOS devices [REL-12323]

Secure Mail Gateway 26.0.3

Fri, 10 Jul 2026 00:00:00 +0200

Updates

Support for self-signed certificates and proxy settings [REL-12714]

Relution 26.3.3

Wed, 01 Jul 2026 00:00:00 +0200

Updates

Exclude obsolete Relution client certificates from key store checks and clean up leftover database entries [REL-11535]

Fixes

Fix an issue with lifetime licenses to provide license claims during license handshake in case the status of the corresponding device has changed [REL-12538]
Fix an issue that prevented certain organizations from performing a license handshake in case certificates of different key sizes where present on the same instance [REL-12481]

Secure Mail Gateway 26.0.2

Tue, 30 Jun 2026 00:00:00 +0200

Fixes

Fix wrongly handled 404 responses [REL-12560]

Secure Mail Gateway 26.0.1

Wed, 17 Jun 2026 00:00:00 +0200

Updates

Expose health endpoint [REL-14913]