Release date: August 10, 2026
Repository: owncloud/ocis
Tag: v8.2.0
ownCloud Infinite Scale (oCIS) 8.2.0 shipped on August 10, 2026. It closes three issues the release labels as security fixes plus a fourth security-relevant bugfix, flips a default that affects any deployment doing OIDC-based group auto-provisioning, replaces the identity provider’s React single-page app with server-rendered HTML, adds an opt-in LDAP connection pool, and fixes roughly 30 other issues, several of them accessibility fixes to keyboard navigation and theme contrast. Administrators running OIDC with group claims should read the security section before upgrading: it changes what happens on the next user login.
Security Fixes
The release labels three issues as security fixes. A fourth, closely related fix is filed as a bugfix but closes off a real denial-of-service path, so it’s included here too.
- Error responses no longer leak internals (#12398). WebDAV error responses, including thumbnail requests, used to include raw internal error messages and filesystem paths. They now return a generic, client-appropriate message, with the detail logged server-side only.
- OIDC group sync is now opt-in (#12490). PROXY_AUTOPROVISION_CLAIM_GROUPS defaulted to groups, which auto-created local oCIS groups from whatever group claim an OIDC provider sent, on every authenticated request. In identity providers that let ordinary users create groups with arbitrary names, this allowed an unprivileged user to inject group names into oCIS. The default is now an empty string, disabling that behavior. Deployments that rely on the old behavior need to set PROXY_AUTOPROVISION_CLAIM_GROUPS=groups explicitly after upgrading, or users will stop being placed into auto-provisioned groups on login.
- PATCH /graph/v1.0/me can no longer change your own password or account flags (#12493). The endpoint no longer accepts passwordProfile, accountEnabled, or onPremisesSamAccountName. Password changes now go through POST /graph/v1.0/me/changePassword.
- exportPersonalData is now rate-limited (#12519) to 5 requests per minute per user, closing off an authenticated denial-of-service vector. The release notes file this one as a bugfix rather than a security fix, and the issue link attached to it in the release notes (#12516) actually points to an unrelated open bug about OnlyOffice/WOPI 404s; the real source is pull request #12519, confirmed directly against GitHub.
Enhancements
The identity provider’s login page no longer runs as a client-side React app. #12086 replaces roughly 21,000 lines of React and its pnpm dependency tree (confirmed: 21,514 deletions against 2,103 additions) with a server-rendered HTML page, keeping existing theming and localization while cutting load time and removing a chunk of frontend attack surface.
Two new capability toggles let administrators turn off sharing paths outright: OCIS_ENABLE_PUBLIC_SHARING (#12542) disables public link creation, and OCIS_ENABLE_USER_SHARING (#12542) disables direct user, group, and federated sharing along with sharee search. Both default to enabled, so no existing deployment changes behavior until an administrator sets them. A related option, PROXY_OIDC_ACCESS_TOKEN_VERIFY_AUD (#12581), restricts accepted OIDC access tokens to a configured audience by checking the aud and azp claims; it’s disabled by default.
LDAP-backed deployments get two changes aimed at replica lag and connection overhead: retries against a lagging replica (#12672, tunable via GRAPH_LDAP_RETRY_MAX_COUNT and related settings) and an opt-in bounded connection pool (#12688, enabled via OCIS_LDAP_POOL_ENABLED, sized with OCIS_LDAP_POOL_SIZE, default 5). The pool is shared between the graph identity backend and reva’s auth, user, and group managers when enabled. A separate change (#12618) removes a redundant LDAP read-after-write by synthesizing create and update responses from the data oCIS already sent, rather than reading them back; the read-back is kept only for the case where the directory server assigns the ID.
A new maintenance command, ocis shares clean-corrupt-public-shares (#12494), finds and removes public-share entries with a nil resource_id that were causing panics in ListPublicShares. It supports –dry-run and works against both the jsoncs3 and json share drivers.
Dependency bumps (#12766) close three published CVEs: go-git/v5 moves from v5.19.1 to v5.19.2 (CVE-2026-71556), and nanoid is bumped on two lines, 3.3.15 to 3.3.17 and 5.1.5 to 5.1.16 (CVE-2026-67213, CVE-2026-67214).
Bugfixes
Around 30 bugs are fixed in this release. Several touch on data correctness: share-update audit events were landing empty because the audit conversion read a deprecated field instead of deriving updated fields from the update mask (#7661, #12423); the graph service’s sharedWithMe handler now bounds per-resource stat calls individually and shows a degraded item instead of losing a share entirely when one resource can’t be statted (#12430); and deleting an already-removed link share now correctly returns 404 instead of 400 (#12266).
Deployment-adjacent fixes include a PostgreSQL container restart loop specific to Keycloak-based deployments, caused by the data volume mount colliding with Docker’s lost+found directory (#12359), and a proxy readiness check that reported false negatives because it checked the NATS cluster ID instead of its events endpoint (#10661, #12421).
A cluster of fixes address accessibility: keyboard navigation in the New/Upload dropdowns (#12646), focus management in the file-versions sidebar (#12630), duplicate breadcrumb announcements (#12643), contrast for form controls in dark and vault themes (#12639), and sign-in error announcements on the login page (#12649), among others.
Upgrade Notes
The change that needs administrator attention before upgrading is the OIDC group sync default. If your deployment sets PROXY_AUTOPROVISION_CLAIM_GROUPS explicitly already, nothing changes. If you were relying on the previous default of groups, set it explicitly after upgrading or new logins will stop being auto-provisioned into groups from OIDC claims. The two new sharing toggles and the LDAP connection pool are opt-in and off by default, so they don’t change behavior unless configured. No other breaking changes are called out in the release.
Credit Where It’s Due
A lot of people worked to make this possible. Thanks to everyone who contributed, especially:
Awab Mohammed (awabcodes) built the webdav error-disclosure fix.
Michal Klos (mklos-kw) is behind the OIDC group sync default flip, the /me account-lockdown fix, the IDP’s React-to-server-rendered rewrite, and the LDAP retry policy.
Roman Perekhod (2403905) rate-limited exportPersonalData, added the OIDC audience restriction, and eliminated the redundant LDAP read-after-write.
Martina Zner (mzner) built the two new sharing toggles.
Lukas Hirt (LukasHirt) forward-ported the opt-in LDAP connection pool from the 8.0.x line to the 8.2.x line.
This post was generated from the GitHub Release description for oCIS 8.2.0, cross-checked directly against pull requests #12398, #12490, #12493, #12519, #12086, #12542, #12581, #12672, #12688, #12618, and #12494. The release family for oCIS relies on a maintainer-written Release body rather than a CHANGELOG.md file at the tag. Read it directly at github.com/owncloud/ocis/releases/tag/v8.2.0.
ownCloud OSPO: moc.skrowetik@opso · kiteworks.com/opensource
