Release 4.3.4

08.10.2026

Missing authorization on file deletion – an authenticated user could permanently delete attachments, including users whose role does not allow deleting files. File deletion now enforces the delete permission on the file [GHSA-hgmw-4wvp-mjq2, GHSA-jfrf-395q-65×9, GHSA-phjj-7h9c-8jrh]
Defense in depth for the view-tools endpoint – an additional restriction on reading user records, intended as a second layer to the fix shipped in 4.3.3, did not take effect. It is now enforced [follow-up to GHSA-hx2v-24xv-xfh5]
Error details hidden outside developer mode – the API now returns a generic “Internal Server Error” response, without the exception message, file, line or stack trace, unless developerMode is enabled. The Doctrine development mode follows the same setting

Markdown field type in Studio – administrators can now add Markdown fields to modules in Studio

List view sometimes failed to load after deleting a record – search results now skip records that are deleted but not yet removed from the Elasticsearch index, instead of failing the whole list. A failed index update is retried once
Supervisor could not accept a work plan – the accept button on Work Schedules failed for the supervisor. It works again
Incorrect translations – labels in Events, PDF Templates and Module Builder have been fixed. The Crowdin export now includes the translatable files of bundled connector sources