{"code":200,"data":{"id":"uezpna21up0g5drs","slug":"version-0-17-3","appearance":"norm","language":"en","rtl":false,"type":"post","created":"2026-11-09T22:44:16Z","updated":"2026-11-09T22:44:15Z","title":"Version 0.17.3","body":"Our latest patch version contains several **critical security fixes**, including one for an authentication bypass that let unauthenticated attackers use the API as another user. It also fixes several other issues around federation, private blogs, and access control. We recommend all admins update to this version as soon as possible.\n\nThis release also updates our [Web Monetization](https://webmonetization.org) support to the latest version of the standard, and includes a handful of bug fixes and improvements for users and admins.\n\n## Security\n\n* **Critical**: Fix authentication bypass via API access tokens (reported and fixed by @diaoqi129, [GHSA-7jv7-gf23-wcqq](https://github.com/writefreely/writefreely/security/advisories/GHSA-7jv7-gf23-wcqq)) \n* Fix private and password-protected blog content exposed via the ActivityPub outbox (by @thebaer, reported by @awanawana, [GHSA-cx5r-gg25-76ph](https://github.com/writefreely/writefreely/security/advisories/GHSA-cx5r-gg25-76ph))\n* Fix server-side request forgery (SSRF) via WebFinger lookups (by @thebaer, reported by @tikket1, [GHSA-wvrr-gx9p-xvxm](https://github.com/writefreely/writefreely/security/advisories/GHSA-wvrr-gx9p-xvxm))\n* Fix unauthenticated SSRF via ActivityPub inbox actor / object resolution (by @thebaer, reported by @iaohkut-from-NightWolf-Team, [GHSA-7635-vx4w-qww7](https://github.com/writefreely/writefreely/security/advisories/GHSA-7635-vx4w-qww7))\n* Fix IPv6 transition address bypass of SSRF protections in federation (by @thebaer, reported by @tonghuaroot, [GHSA-22qx-x758-m72p](https://github.com/writefreely/writefreely/security/advisories/GHSA-22qx-x758-m72p))\n* Add CSRF protection to account settings endpoints (`/me` and `/api/me`) (by @thebaer, reported by @hacktivat0r and coordinated by @u9000-Nine, [GHSA-mp2f-3fq8-r9vj](https://github.com/writefreely/writefreely/security/advisories/GHSA-mp2f-3fq8-r9vj))\n* Enforce the maximum blogs per user limit when creating blogs via the API (by @thebaer, reported by @tonghuaroot, [GHSA-g4m9-5p4q-ch24](https://github.com/writefreely/writefreely/security/advisories/GHSA-g4m9-5p4q-ch24))\n* Prevent users from changing settings on another user's blog via the API (by @thebaer, reported by @N0el4kLs, [GHSA-7mmq-gh5f-97p3](https://github.com/writefreely/writefreely/security/advisories/GHSA-7mmq-gh5f-97p3))\n* Prevent users from changing metadata on blogs they don't own (by @thebaer, [GHSA-wqc7-9ph9-m5fm](https://github.com/writefreely/writefreely/security/advisories/GHSA-wqc7-9ph9-m5fm)) \n* Fix stored XSS via unsanitized post slugs in RSS, email, and ActivityPub output (by @thebaer, reported by @geo-chen, [GHSA-cwxm-8ch5-j2vh](https://github.com/writefreely/writefreely/security/advisories/GHSA-cwxm-8ch5-j2vh))\n* Prevent users from pinning or unpinning other users' posts (by @thebaer, reported by @5ud0er, [GHSA-hwfg-mg9c-cvgf](https://github.com/writefreely/writefreely/security/advisories/GHSA-hwfg-mg9c-cvgf))\n* Enforce signup checks consistently across all registration paths, extending the invite code validation from v0.17.2 to API and OAuth signups, by @thebaer in https://github.com/writefreely/writefreely/pull/1748\n\n## User-Facing Changes\n\n* Update Web Monetization support by @thebaer in https://github.com/writefreely/writefreely/pull/1784\n* Include image alt text in fediverse attachment data by @thebaer in https://github.com/writefreely/writefreely/pull/1729\n* Fix password-protected blogs not unlocking after cookie expires by @thebaer in https://github.com/writefreely/writefreely/pull/1727\n* Normalize usernames on signups via OAuth by @thebaer in https://github.com/writefreely/writefreely/pull/1730\n* Fix bad navigation on collection customize page by @snullp in https://github.com/writefreely/writefreely/pull/1738\n\n## Admin-Facing Changes\n\n* Output more helpful error messages at startup by @thebaer in https://github.com/writefreely/writefreely/pull/1731\n* Support serving robots.txt on single-user instances by @thebaer in https://github.com/writefreely/writefreely/pull/1736\n\n## Developer-Facing Changes\n\n* Hide `first` property in followers/following collections when 0 items by @thebaer in https://github.com/writefreely/writefreely/pull/1733\n* Update Docker and release builds to Go 1.26 by @thebaer in https://github.com/writefreely/writefreely/commit/95e1918e10414e51a38afbd9bf9a1948d39f686c\n\n### Dependencies and minor fixes\n\n* Bump alpine from 3.18.4 to 3.24.3 in the Docker image by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1786\n* Remove deprecated `-d` flag from `go get` in Makefile by @thebaer in https://github.com/writefreely/writefreely/commit/50dedcd05a31a5679cd34b8aea3bbc82501595b1\n* Prefer local `lessc` install over global when building stylesheets by @thebaer in https://github.com/writefreely/writefreely/commit/37d5e01013f9ee00c078a7eed7d3c7ce78809f9a\n* Fix Dependabot Docker update directory by @thebaer in https://github.com/writefreely/writefreely/commit/5906aa9f93f4a7b20f15ffc5b0ef7cdfc0ff64a5\n* Bump golang.org/x/crypto from 0.54.0 to 0.58.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1780\n* Bump github.com/writeas/web-core from 1.7.0 to 1.8.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1714\n* Bump docker/login-action from 4.3.0 to 4.6.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1712\n\n## Upgrading from v0.17.x or earlier\n\n1. Download the latest release for your operating system and architecture\n2. Stop running your `writefreely` server\n3. Replace all files in your installation (**except** for the `keys` directory) with the ones in the archive\n4. _(Only when upgrading from \u003c v0.17.0)_ Update your database by running:\n    ```\n    writefreely db migrate\n    ```\n5. Start your `writefreely` server again\n6. _(Recommended)_ Revoke existing API access tokens, as described below\n\nIf you're upgrading from a much earlier version, follow the instructions in each [previous release](https://blog.writefreely.org/tag:release).\n\n### Recommended: revoke existing API access tokens\n\nUpgrading closes the authentication bypass ([GHSA-7jv7-gf23-wcqq](https://github.com/writefreely/writefreely/security/advisories/GHSA-7jv7-gf23-wcqq)), but doesn't invalidate API access tokens that already exist. As an extra precaution, in case any were exposed before you upgraded, we recommend revoking all existing tokens once your upgraded instance is running.\n\nDoing this will sign all users out of apps and tools that use WriteFreely's API, such as mobile apps, command-line clients, and other integrations. They'll need to log in to those again. People signed in to WriteFreely on the web stay signed in.\n\nThere's no `writefreely` command for this, so you'll need to clear the `accesstokens` table directly. Use the database details from your `config.ini`:\n\n**SQLite**\n\n```\nsqlite3 /path/to/writefreely.db \"DELETE FROM accesstokens;\"\n```\n\n**MySQL / MariaDB**\n\n```\nmysql -u \u003cusername\u003e -p \u003cdatabase\u003e -e \"DELETE FROM accesstokens;\"\n```\n\nOptionally, to invalidate web sessions, you can also regenerate your session keys using the steps below. This will require all users to log in again, and for readers to re-enter passwords for any password-protected blogs.\n\n1. Stop WriteFreely\n2. Back up your `keys` folder temporarily\n3. Delete `keys/cookies_auth.aes256` and `keys/cookies_enc.aes256` (do **not** delete `keys/email.aes256`)\n4. Run `writefreely keys generate` as the same user as your server\n5. Start WriteFreely again\n\n**Full Changelog**: https://github.com/writefreely/writefreely/compare/v0.17.2...v0.17.3\n\n#WriteFreely #release","tags":["WriteFreely","release"],"paid":false,"full_post_url":"","views":87,"likes":8}}