Nuphos
Download

October 23, 2026

Backend 0.101.11 security update for self-hosted Nuphos

Backend 0.101.11 fixes a critical access-control issue in GitHub App binding. Nuphos Cloud is already protected; self-hosted backends should upgrade.

Yuanlin Lin
Yuanlin Lin

Security

This release fixes a critical access-control issue in GitHub App installation binding. Nuphos Cloud has run with this fix since 2026-10-23. Self-hosted backends on v0.101.10 or earlier are affected; upgrade to v0.101.11 or later and apply the two GitHub App settings under Upgrading.

  • GitHub App installation binding: binding an installation to a team checked that the installation existed, but not that the person binding it had access to it. A team administrator could bind another account's installation and use it from their team. Bindings are now created only by the backend's setup callback, after the installing user authorizes the GitHub App, the installation is confirmed for that user, and the user confirms the destination team.

After upgrading, we recommend reviewing your existing GitHub installation bindings and removing any you do not recognize.

Upgrading from v0.101.10

  1. No database changes. A backup is still recommended before any upgrade.
  2. Before upgrading, configure the GitHub App OAuth client, or adding a new GitHub installation fails (existing bindings are unaffected):
    • Set GITHUB_APP_CLIENT_ID and GITHUB_APP_CLIENT_SECRET to the GitHub App's OAuth client ID and secret.
    • Make sure the backend knows its public HTTPS address: NUPHOS_PUBLIC_BACKEND_URL, or NUPHOS_BACKEND_URL if that already holds the public HTTPS URL.
    • In the GitHub App settings, add <your public backend URL>/github-app/setup to the callback URLs, and keep "Request user authorization (OAuth) during installation" unchecked.
    • GITHUB_APP_SLUG and GITHUB_APP_SETUP_REDIRECT are still required, as before.
  3. Update the image and restart:
    • Compose: check out backend-v0.101.11, rebuild the backend, and run docker compose up -d backend.
    • Railway: set the backend service image to ghcr.io/nuphos/backend:v0.101.11.
    • Zeabur: set the backend image to v0.101.11.
    • Helm: set backend.image.tag: v0.101.11.
  4. Check that /health returns 200, then add a GitHub installation from Integrations to confirm the flow.

Read the full backend v0.101.11 release notes.

Yuanlin Lin
Yuanlin Lin

Founder of Zeabur, the team building Nuphos.