Captivo Access changelog — 2026 · Page 2 of 13

Added

• Your Captivo account page is now reachable from the console — a "Captivo account" entry in the avatar menu, top right. It shows your organisation and what you hold in each Captivo product. The page had existed for a while with nothing linking to it, so anyone who did not already know the address could not find it.
• Self-hosted consoles have no such page and show no link.

Fixed

• Leaving for the other product with the switcher now records that choice. Captivo takes you to the product you last entered when you sign in without asking for a particular page — but only signing in used to count. You could switch to Captivo Portal, work there, sign out, and be sent back to Access at your next sign-in. Pressing the switcher says "I want to be there now" just as clearly, and it is now treated that way.
• The destination is resolved on our side rather than taken from the link, so this cannot be used to send a signed-in person to an arbitrary address.

Fixed

• Signing up here now counts against the platform's per-IP registration limit. The identity service caps how many accounts one address may create, but it cannot use the address our own request arrives over — that is this server, one bucket for every customer — so the cap only applies when the product supplies the end user's address. This door did not, which meant the limit simply did not exist for signups made here; the signed confirmation link and the per-email cap were the only brakes. The address is read from the request that opens the confirmation link, and is omitted rather than guessed when it cannot be determined.

What's new in 1.13.12

• New: remote sessions work on a phone or tablet. Touch moves and clicks the mouse, pinch zooms, and the device's own keyboard opens for typing, on a layout built for small screens.

What's new in 1.13.11

• Fixed: in an isolated browser session the streaming engine's own control bar could appear over Captivo's. It is hidden again, the on-screen keyboard works, and the clipboard panel can be opened by hand.
• Fixed: signing in through the platform address no longer offers to create a workspace that already exists.

What's new in 1.13.10

• New: session engine capabilities are now exposed as settings — sound and printing in RDP sessions, the terminal's appearance, streaming quality for isolated browser sessions, and a DLP watermark on web-app sessions.
• New: the session screen is Captivo's own: a control panel, one consistent recording notice, a drop target for file transfer, and tips on first use.

Changed

• Signing in here now tells Captivo that this is where you work, so a later sign-in that carries no product intent — the Captivo Portal login page, or the account page — brings you back to Access instead of dropping you in Portal. Nothing to configure. If you arrived through a link to a specific page, that link still wins.
• Support sessions are deliberately excluded: a platform operator opening your console does not change where you land.

Changed

• There is no trial plan any more — the free tier is the trial. A workspace no longer expires because a clock ran out; you keep it, and buy more capacity if you need more connectors or resources. This also removes a split nobody was told about: the self-service signup door created a 14-day trial while the Captivo-account door gave a free workspace that never expires. Both now give the same thing.
• The platform console drops the Trial filter, the trial badge and the trial end-date field, and the job that suspended a workspace when its trial ended is gone with them.

Fixed

• "Inherit" now says what it inherits. On a resource, the clipboard option read "Inherit (policy default)" and the isolated watermark "Use global default" without telling you what that resolved to; they now read "Inherit policy (Allow copy & paste)" and "Inherit policy (On|Off)", matching the Guacamole fields. In the policy form, the watermark switch and the recording-mode select showed the stored value only, ignoring the server defaults that actually applied when nothing was stored — both now start from the value in force.

What's new in 1.13.7

• Fixed: pasting into a session uses the browser's own paste event, so Ctrl+V behaves as expected.
• Fixed: when file transfer is turned off the session says so, instead of failing without explanation.
• Fixed: connection fields left on "Inherit" show the value they actually resolve to.

Added

• Connectors and Resources now show how much of your plan's allowance you have used — for example "Free plan: 2 of 5 resources used". Until now the limit existed and was enforced, but nothing showed it: you found out by hitting it, as an error, in the middle of adding something. The line stays a plain statement of fact and only tells you what to do when you are actually at the cap.
• Self-hosted installations are not limited and show no such line.

Changed

• The version number now says which product it belongs to. The updates page read "This manager: v1.13.4", which said nothing about whether that was Captivo Access's number or Captivo Portal's — the two are numbered independently and sit side by side for anyone who uses both. It now reads "Captivo Access: v1.13.5".

Fixed

• The address recorded against a sign-in is now one the caller cannot choose. Two places wrote the session's origin from the first forwarded hop — a value anyone can set on their own request — so the IP shown for a sign-in, and for a support session opened on a customer tenant, could be made to say anything. Both now read the address the front proxy wrote, as the rest of the console already did.

Fixed

• A workspace that fails to finish being created is now removed instead of left behind. If anything went wrong after the workspace row was written, what survived was a workspace you could reach but not use — on the wrong plan, without its limits, with no way to sign in — and it still held the console address you had chosen, so trying again at that address was refused. The address is now free again and the error tells you what actually went wrong.

Fixed

• Creating a free-tier workspace failed halfway. Choosing a console address and pressing Create workspace ended in an error, and the workspace it left behind was incomplete: its plan and the free tier's limits were never applied, and the identity service was never told where the new console lives — which is what makes sign-in there possible. The cause was a plan name the product knew and the database did not.
• A newly created workspace's console was a dead end. Visiting it sent you to the first-admin setup wizard, which cannot be completed on a customer console — admins there arrive by invitation — so the Sign in with Captivo button was on a page you could never reach. The console now shows the sign-in page, and the setup wizard no longer offers a form it cannot finish.

Fixed

• Signing in with Captivo could be refused for people who were entitled to Access. Arriving from Captivo Portal and choosing Sign in with Captivo ended at "No account for that identity — ask an administrator to invite you", even for an organisation that holds Access. The sign-in request was not asking Captivo ID for the part of the token that says what you may open, so the console saw an account with no entitlements at all. Self-hosted consoles pointed at their own identity provider (Keycloak, Entra, Auth0 and the like) are unaffected and keep the same request as before.
• A refused sign-in now says which of the three reasons it was in the manager log — no account, no invitation, or no entitlement in the token. They were indistinguishable from the browser, which made the bug above far harder to find than it should have been. No email address is written to the log.

Changed

• The product switcher now takes you into the other product signed in. It used to open that console's front page, where you were handed a login form and had to sign in a second time to do what you had already asked for.

Switch between your Captivo products from the console

If your organisation has more than one Captivo product, the top navigation now

lets you move between them. A product you have already set up links straight

through to its console; one you have not is marked Needs setup and takes you

to the setup flow.

A product your organisation is not entitled to does not appear at all, and if

there is nothing to switch to the menu stays hidden rather than showing a single

option.

Self-hosted installations are unaffected. The switcher only appears when the

installation is connected to Captivo ID, so a self-hosted console looks exactly

as it did before.

---

What's new in 1.12.0

• New: an account entitled through Captivo ID can create its own workspace. Confirm the address and the workspace is ready — no request to anyone.
• New: an open-ended free tier, and per-workspace limits the platform can set.
• Fixed: the sign-in token's signing secret is pinned to a single source, tokens carrying extra segments are rejected, and workspace creation refuses requests it should not serve.

What's new in 1.11.9

• New: a self-service sign-up is registered with Captivo ID, so the same account works across Captivo products.
• Fixed: sign-up no longer waits a long time when Captivo ID is slow to answer; it gives up after five seconds and continues.

What's new in 1.11.8

• New: on a customer's own server Captivo ID is never contacted. Sign-in uses only what is configured on that installation.

What's new in 1.11.7

• Fixed: the Captivo ID sign-in button is in English, like the rest of the console.

What's new in 1.11.6

• Fixed: after signing in with Captivo ID you return to your own console address. This undoes the single fixed return address introduced in 1.11.4.

What's new in 1.11.5

• Fixed: signing in with Captivo ID no longer fails when the console is reached on a different subdomain than the one sign-in started from.

What's new in 1.11.4

• Changed: Captivo ID sign-in returned to one fixed address rather than the workspace's own. This was reverted in 1.11.6, which restored the workspace address.

What's new in 1.11.3

• New: a workspace with no identity provider of its own can sign in with Captivo ID.

What's new in 1.11.2

• Security: 16 dependency advisories closed, two of them remote code execution reachable without signing in. Updating is recommended for every installation.