Captivo Portal changelog — 2026 · Page 1 of 12

Improvements

• The VPN MFA module was removed from Captivo Portal.

Fixes

• On the sign-in page Captivo serves (UniFi and portals opened through the portal link), voucher, hotel and sponsor-approved sign-ins were rejected. Fixed.

Improvements

• The mobile app now asks for the two-step verification of the Captivo account: someone with an authenticator on their Captivo account enters the same authenticator code on the app's code screen after the password. People whose organisation requires two-step but who have not set it up, and organisations that allow enterprise sign-in only, are told what to do instead.
• Mobile sessions now end at once on "sign out everywhere", a password change, a change at the Captivo account and deactivation; they used to stay open.

Fixes

• Someone with two-step verification on their Captivo account could sign in to the mobile app, or through the panel's local sign-in form, with the password alone. The local form now sends these accounts to "Sign in with your Captivo account".
• For users who sign in with their Captivo account, the dashboard setup checklist's "Secure your account (2FA)" step now reflects two-step verification on the Captivo account, and its "Set up" button opens the Captivo account page. It used to set up the panel's own verification, which then asked for a second code at sign-in.

Improvements

• Users who sign in with their Captivo account now also sign out of it when they sign out of the panel, and land on the Captivo sign-in page; the panel's own sign-in page remains for local-password accounts and on-premise installations.

Fixes

• A stale session left in the browser after signing out elsewhere or a role change caused a "too many redirects" error when opening the panel or the admin console. The stale session is now cleared and the sign-in page opens.

Improvements

• When you change the e-mail address of your Captivo account, your panel account moves to the new address at once and your open sessions end to be renewed. If the new address already belongs to another panel user, nothing changes. No change for accounts with a local password or for on-premise installations.

Improvements

• Signing out of your Captivo account (or having your password or two-step verification reset there) now ends your open panel sessions at the same moment. No change for accounts with a local password or for on-premise installations.

Improvements

• Removing a member or changing their role on your Captivo account's organisation page now reaches the panel at once: a removed person is deactivated and their open sessions end immediately, and a person whose role changed continues with the new role from their next request. These used to wait for that person's next sign-in.

Improvements

• For users who sign in with their Captivo account, the Security page no longer shows Portal's own two-step verification, recovery code and trusted device sections; they are managed in the Captivo account, so the page points there. The "set up two-step verification" reminder is not shown to them either. Accounts with a local password and on-premise installations see the page as before.

New

• The organisation role on your Captivo account now runs your panel at every sign-in: an Owner or Admin of the organisation arrives as a panel Admin, a Member as a User, and a role you change on the Captivo account shows in the panel at the next sign-in. The panel can only narrow a role (an organisation admin can be made a Manager); a Member of the organisation cannot be made a panel Admin. Someone you remove from the organisation can no longer sign in and is deactivated.

Improvements

• On a panel that belongs to a Captivo organisation, the Team page says that organisation members are invited on the Captivo account page and links there. Members with the Captivo badge cannot be removed on this page and their role choice stays within what their organisation role allows; the invite here remains for local users without a Captivo account.

Improvements

• Creating a new account now happens on your Captivo account's own page: "Sign up" takes you to the Captivo registration form. One form, one verification link in your inbox; once verified you sign in and set up Portal, and Captivo Access if you wish, from your account page. Existing accounts and sign-in paths are unchanged.

Improvements

• When you sign in with Captivo without heading for a specific page, your Captivo account page now opens first: your organisation, which products you use on which plan, products awaiting setup or expired, and your security settings in one place, with a one-click jump to the product you want. Previously the sign-in took you to the product you last used without asking. The "Go to product" link on the account page and password sign-in still land directly in the panel.

New

• A colleague you invite from your Captivo account's organisation page now joins your panel directly when they sign in with Captivo: as a panel admin if they are an owner or admin of the organisation, as a viewer if they are a member. Previously that sign-in failed.

Improvements

• Two-step verification is no longer asked twice when you sign in with Captivo. If your Captivo account already checked your code (or you came from a browser it trusts), Portal skips its own code screen; if your Captivo account took no second step, Portal's code is asked as before. Local password sign-in and your MFA settings in Portal are unchanged.

New

• A Troubleshooting section in the documentation: The portal does not open, Sign-in is rejected, Sessions do not appear, SMS messages do not arrive, Emails do not arrive — each with the symptom, quick checks, likely causes and what to collect before writing to support.
• "Was this article helpful?" under every documentation page, with an optional short comment.

Improvements

• The documentation index and side menu are grouped into Setup, Platform settings and Troubleshooting; each device guide's troubleshooting section links to the product-wide pages.

New

• A new alert: you are now notified, in the panel and by e-mail, if your guest logins go quiet for longer than is normal for your own rhythm. A low-volume site with just one or two logins a day is covered too — the threshold is not a fixed number, it is based on your own past usage, so a quiet hour does not trigger a false alarm. You are also told once logins resume.

Fixes

• Some guests saw an unexplained error and could not connect when signing in by SMS or email, or when being approved by a sponsor. This happened when a guest who had previously registered with only a phone number or only an email address later had a second piece of information (the other of the two) -- entered at sign-in or on the sponsor's approval -- that already belonged to a different guest. That conflicting piece is now simply skipped, and the operation completes without an error.

Improvements

• The setup documentation has left the panel for a public address: captivo.io/en/docs (Turkish at captivo.io/dokumanlar). Every topic now has its own page, with a sidebar for moving between topics and an in-page table of contents for jumping straight to a step — on a phone as well. Links inside the panel point to the new address.
• Release notes open from the sidebar and are published in both Turkish and English.

Fixes

• Signing in with SMS from the guest portal failed. On a portal served from the NAS the browser blocked the request for the code, and the screen showed an error with no cause; installations running a recently downloaded template were affected.
• Turkish characters are no longer missing from error and status messages: a guest who hits the rate limit now reads "Çok fazla istek gönderildi, lütfen bekleyin". Some messages were spelled correctly already but passed through a step that stripped Turkish letters on the way to the screen; that step is gone. SMS and e-mail provider messages and panel text are covered too.

Improvements

• Upgrading now reclaims the disk space of the version it replaces. The previous version and leftover unused copies (about 2 GB on one installation) are cleared automatically on every upgrade, and the cleanup only touches Captivo's own files, never other software on the server.

Improvements

• The activity log now shows which 5651 archive was downloaded: the day (or date range) and the signature digest of the file that was handed over. It previously said only "archive downloaded", which left no way to tell which record had been released.

Fixes

• Security: the email library was updated — a specially shaped address could route a message to a recipient other than the intended one.

Fixes

• Downloading a 5651 archive for a busy day would start and then hang for minutes without finishing. The archive now goes straight to the requested day's records, so the download streams without the wait.

Improvements

• In the dark theme, the text on blue buttons looked washed out and was hard to read. Text on a coloured button is now clearly legible in the dark theme too — most visibly on the sign-in and registration screens.

Fixes

• On the Documentation page, tables cut off their last columns on a phone or in a narrow window, and there was no way to reach those columns at all. Fixed — tables now scroll sideways within themselves.

Fixes

• If Lato was your brand font, the letters ş, Ş, ğ, Ğ and İ were drawn in a different typeface from the rest of the text in the panel. Fixed — all text now uses one typeface. Only Lato was affected; the other nine choices and the portal screens your guests see were not.

Fixes

• On a self-hosted installation, upgrading could do nothing at all: you downloaded the new package, ran the installer, it finished successfully, and the server stayed on the old version. Fixed — running the installer now moves you to the version in the package. If an earlier upgrade of yours had no effect, try again with the new package.

Fixes

• The signed log archive for a busy day could not be downloaded: the page failed with an error. This is why quiet days downloaded fine while busy ones did not. Fixed — the archive now downloads whatever its size.
• Turkish characters in the log lines inside a downloaded archive were corrupted, which also invalidated the archive's signature check: the file opened, but you could not prove its contents were unaltered. Fixed. Archives you downloaded earlier are affected — simply download them again; no records were lost and a freshly downloaded archive passes verification.

New

• The sign-in, sign-up and password-reset screens have been redesigned.
• While you type your company name on the sign-up form, you can see what your account address will be.
• The password field now shows your administrator's rules one by one, so you can see which condition is still missing before you submit.

Fixes

• The password-reset screen always said "at least 8 characters" regardless of the minimum your administrator had set. It now shows the real value.
• Some company names could produce an invalid account address during sign-up.
• The free-plan summary on the sign-up page listed three features the plan does not include.