Khoros Communities 26.1 Release Notes

The Khoros Communities 26.1 release delivers critical security patches including RCE vulnerability remediation, extensive accessibility improvements for mobile screen readers, and stability fixes across moderation workflows, content management, and API functionality.

Classic

• Fixed badges being awarded before posts were approved on pre-moderated boards.
• Fixed anchor links within posts failing to scroll to their target sections.
• Fixed quoting posts with code samples throwing errors for users with Simple HTML permissions.
• Fixed top contributors widget displaying users in incorrect order.
• Fixed Table of Contents button not appearing in blog article editor when enabled.
• Fixed search autocomplete retaining incorrect selection when cursor moved away quickly.
• Fixed Accept Solution option missing from Group posts.
• Fixed solutions leaderboard showing fewer users than configured when role filters were applied.
• Fixed external video embeds from Brightcove and other providers failing to render.
• Fixed Vimeo embeds with longer video IDs disappearing after publishing.
• Fixed "Show older messages" in Private Messages causing page refresh on repeated clicks.
• Fixed ban edit popup displaying empty for deleted users.
• Fixed product and tag autocomplete failing with special characters like "/" and "_".
• Fixed GroupHub subscription status displaying incorrectly after page reload.
• Fixed admin metrics date range filter returning results outside specified dates.
• Fixed orphaned HTML appearing in posts when mentioned users were deleted.
• Added support for .f3z file attachments.
• Fixed Hi-Labels validation incorrectly triggering when editing attachments or comments.
• Fixed role filter in Community Analytics throwing errors.
• Fixed TKB and Blog workflow notification emails not being sent when spam filtering was triggered.
• Fixed archive search filter counts showing zero despite archived content existing.
• Fixed user search filter state lost after browser back navigation.
• Fixed Safari on macOS intermittent failures with sort filters and post actions.
• Fixed email validation not being enforced during registration, allowing accounts without email addresses.
• Fixed notifications not being delivered for posts on pre-moderated forums after approval.
• Fixed Private Messages failing to load for users with certain message history patterns.
• Changed PDF attachments to use native browser viewer instead of third-party preview.
• Implemented clipboard content sanitization in rich text editor to prevent XSS attacks.
• Added accessibility improvements including: visible focus indicators on message links; tooltip text visibility at 200% zoom; proper ARIA attributes for image and video upload modals; keyboard controls for Brightcove video timeline; and corrected form field descriptions for screen readers.

Aurora

• Fixed required custom fields not displaying in Add User form, preventing member creation.
• Fixed group names exceeding 40 characters failing silently instead of showing error messages.
• Fixed event calendar invite links navigating to incorrect page format.
• Fixed lock icon not displaying on ideas with commenting disabled.
• Fixed content formatting errors for users with Simple HTML permissions when applying alignment to lists.
• Fixed user timezone reverting to default after SSO login.
• Fixed unsupported tag warning not appearing when moving posts with newly added tags.
• Fixed moderators not receiving email notifications for content on moderated boards.
• Fixed moderator Reject menu immediately closing on Windows with display scaling above 100%.
• Fixed custom endpoints returning 404 errors after deployments.
• Fixed "Show more" button in Ideas widget failing to load additional results.
• Fixed Q&A structured data not rendering for search engine crawlers, affecting SEO.
• Fixed anchor links failing to scroll when target section was below the link.
• Fixed lock indicator not displaying on threads with zero comments.
• Fixed Knowledge Base and Ideas pages not respecting 100% page width setting.
• Fixed images uploaded to landing page widgets displaying as broken.
• Fixed Private Messages inbox failing to load for certain users.
• Fixed SSO logout not ending session at Identity Provider, causing automatic re-login.
• Fixed "Show More" button replacing visible replies instead of adding more at certain depth levels.
• Fixed all file attachments returning 404 errors in certain timezone configurations.
• Fixed user search returning empty results for certain username formats.
• Fixed custom pages returning 404 errors after component deployments.
• Fixed SDK Preview mode causing infinite page refresh loop.
• Fixed GraphQL Admin operations failing in custom endpoints for authenticated users.
• Fixed plugin build failures due to ESLint resolver incompatibility.
• Updated event calendar invites to use community mailer address instead of organizer email to protect privacy.
• Updated Next.js to address critical remote code execution vulnerabilities.
• Implemented validation for image URL uploads to prevent server-side request forgery attacks.
• Added react-markdown as allowed dependency for custom component development.
• Added comprehensive accessibility improvements including: swipe accessibility for tag menus, username filters, and author comboboxes on mobile; proper expanded/collapsed state announcements for all menus and navigation elements; descriptive button labels for message actions, replies, and status controls; proper tab selection announcements; content reflow after device orientation change; and hamburger menu labels reflecting current state.

Pre-Prod Rollout: January 28-29. Testing window open from Jan 29 through Feb 11.
Production Rollout: February 13-14 
The rollout will follow the standard maintenance windows