Redmine 7.0.1, 6.1.4 and 6.0.11 released

2026-08-28  •  Tags: , , ,  •  KUROTANI Akihiro

Ad: My Redmine Global Edition: A simple cloud-based Redmine service

On August 26, 2026 (Central European Time), Redmine 7.0.1, 6.1.4 and 6.0.11 were released. These releases include several security fixes.

What is Redmine:
Redmine is an open-source project management tool. It can be freely installed in your own environment, such as an on-premises server, and cloud services are also available.

Security information

All three released versions include the following security fixes:

  • Defect #44249: API requests can affect a user's session and circumvent security policies
  • Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
  • Defect #44309: Nested issue-relations endpoints bypass source issue visibility
  • Defect #44310: Child project inherit_members updates bypass member-management authorization
  • Patch #44371: Filter key parameter from logging

Changes

Common changes in 7.0.1, 6.1.4 and 6.0.11 (12 changes)

Accounts / authentication

  • Defect #44360: Lost password page is unreachable by admins when two-factor authentication setup is required
  • Defect #44245: Password reset page exposes whether an email address is registered through different redirect behavior

Code cleanup/refactoring

  • Patch #44330: Convert CRLF line endings to LF in three test fixture files

Email notifications

  • Defect #44220: Backport password reset security notification does not include IP address

Permissions and roles

  • Patch #44328: Reading issue categories should be granted by view_issues, not manage_categories

SCM

  • Defect #44354: GitAdapterTest#test_diff_path_invalid fails with Git 2.55.0

Security

  • Defect #44249: API requests can affect a user's session and circumvent security policies
  • Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
  • Defect #44309: Nested issue-relations endpoints bypass source issue visibility
  • Defect #44310: Child project inherit_members updates bypass member-management authorization
  • Patch #44371: Filter key parameter from logging

Text formatting

  • Defect #13723: Collapse doesn't work with section edit link

Common changes in 7.0.1 and 6.1.4 (8 changes)

Accounts / authentication

  • Defect #44343: Deleting a user who has authorized an OAuth2 application fails with ActiveRecord::InvalidForeignKey

Administration

  • Defect #44273: Applications item is not highlighted in the administration menu

Attachments

  • Defect #44216: Backport uploading files with excessively long extensions may fail

Documentation

  • Patch #44232: Document Ghostscript as an optional dependency in doc/INSTALL

Issues

  • Defect #44258: Deleting an issue journal (note) shifts #note-N anchors of later journals, breaking existing links

SCM

  • Defect #44223: Setup Subversion and Mercurial on GitHub Actions

Translations

  • Defect #44291: Fix typos and inconsistent "e-mail" spelling in Czech translation

UI

  • Defect #44221: "Selected Columns" checkbox does not enable or disable the column lists on the new Gantt query form

Common changes in 6.1.4 and 6.0.11 (1 change)

Rails support

  • Patch #44304: Update Rails to 7.2.3.2

Changes only in 7.0.1 (21 changes)

Accounts / authentication

  • Patch #44368: Revert removal of user scope in 2FA backup code lookup

Administration

  • Defect #44289: No status icon is displayed after checking for plugin updates on the Plugins page
  • Feature #44268: Prevent browsers from autofilling the administrator's own password into the user account form

Attachments

  • Defect #44225: Add and configure pandoc on GitHub Actions
  • Defect #44228: Uploading an attachment with a NUL byte in the filename causes an Internal Server Error
  • Defect #44335: PDF preview of .ai attachments triggers an automatic download

Code cleanup/refactoring

  • Defect #44243: Fix RuboCop Style/ArrayIntersect offenses
  • Defect #44321: Random test failure in OauthProviderSystemTest due to incomplete sign out
  • Patch #44259: New context menu controller tests don't run with standard rake tasks
  • Patch #44265: WebhookTest occasionally hangs

Gantt

  • Defect #44234: Gantt issue relation lines break when collapsing objects

Performance

  • Defect #44348: Formatting a text is much slower in 7.0.0 when its container has many attachments

Rails support

  • Patch #44303: Update Rails to 8.1.3.1

REST API

  • Feature #44353: Add project to wiki page list API response

Third-party libraries

  • Defect #44294: Charts are broken: empty app/assets/javascripts/chart.min.js shadows vendor/javascript/chart.min.js

Translations

  • Defect #44277: Translation missing: text_users_remove_from_group_confirmation
  • Patch #44323: French translation update for 7.0-stable

UI

  • Defect #44318: Tab bar wraps to a semi-visible second row when the tabs are wider than 2000px
  • Defect #44351: Fix top menu position in Classic theme
  • Patch #44293: Add a caret to the account menu to indicate it opens a dropdown
  • Patch #44341: Increase top menu hover highlight by increasing the padding of the elements

Related information

Ad: My Redmine Global Edition: Redmine Cloud Hosting 100 USD/month
Created: 2026-08-28  •  Tags: , , ,