MRBS 1.12.2 release notes

MRBS 1.12.2 was released on 26 May 2026. This manual is written for that release.

Security

The release includes:

• prevention of open redirects;
• fixes for potential open redirects in several paths;
• a kiosk-mode open redirect fix, tracked as CVE-2026-46688; and
• an import-related server-side request forgery fix, tracked as CVE-2026-46382.

Compatibility and maintenance

Notable changes include:

• PHP 8.5 compatibility fixes;
• improved detection of missing PDO drivers;
• recommendations for the intl and mbstring extensions;
• PHPMailer updates;
• locale and language handling improvements; and
• updated timezone URL data.

Functional improvements

The release adds or improves:

• iCalendar components;
• import and export of custom fields;
• default values for new-entry custom fields;
• case-insensitive user sorting;
• booking-policy handling for administrators; and
• kiosk behavior in multisite installations.

For the complete change history, read the NEWS file shipped with MRBS 1.12.2.

Note

Release notes summarize changes; they are not a substitute for the upgrade procedure or a review of local configuration.