New Features & Enhancements

Self-Healing Retry Logic for QuikLink Connectors (16352)

• • Engineered automatic retry logic into QuikLink connectors for transient authentication and network failures eliminating immediate error states, removing the need for manual restarts, and ensuring uninterrupted privacy request processing.

Automated Alerts and Notifications for Repeated Connector Failures (16413)

• • Strengthened QuikLink connector resilience by introducing self-healing task recovery: failures are retained in Pending (P) for automatic retry and instantly raise email and portal alerts with complete failure context.

Client-Configurable Weekend Due Date Shift for Privacy Requests (16332)

• • Added a configurable option that allows clients to automatically reschedule privacy request due dates falling on a Sunday to the following Monday, with the original Sunday date and reschedule reason recorded on the request details.

Data Retention extension for Preference Center Analytics (16533)

• • Extended Preference Center data retention (TTL) to 3 years, enabling long-term analytics and reporting continuity.

Controlled Auto Data Fetch Creation for New Identification Keys During Upload (16397)

• • Introduced a configurable setting that determines whether adding new identification keys during the Upload Data process automatically generates additional Data Fetch requests, with the setting enabled by default to preserve existing behavior.

---

Security Updates

App-Wide CSRF Protection with SameSite Cookie Attributes and Server-Side Token Validation (15721)

• • Fortified the application against site-wide Cross-Site Request Forgery (CSRF) attacks by enforcing SameSite, HttpOnly, and Secure attributes on session cookies, implementing server-side CSRF token validation for all state changing requests, and eliminating the 2-minute exploitation window ensuring every privileged action is cryptographically verified and immune to cross-origin forgery.

Secure File Upload Endpoint (15723)

• • The file upload endpoint has been secured with authentication, CSRF validation, file type/MIME restrictions, size limits, and encoding validation to prevent unauthenticated access, malicious file hosting, stored XSS, and storage abuse.

Egnyte Authentication Security (15725)

• • Strengthened the Egnyte Authentication integration by enforcing strict allowlisting of trusted domains, preventing bearer token transmission to user-supplied endpoints, and reinforcing CSRF protection and secure session handling to mitigate Blind SSRF and token exposure risks.

Stored XSS in Assessment Submissions Mitigation (15720)

• • Added server-side HTML sanitization to assessment free-text inputs, stripping dangerous tags, removing inline event handlers, and blocking javascript injection attempts to prevent stored XSS payloads from executing when administrators review submitted responses.

Reflected XSS Vulnerability Mitigation via WAF Bypass (15724)

• • Fixed a reflected XSS vulnerability where attackers could bypass WAF rules using backtick-based character-stripping to inject malicious scripts, by adding contextual output encoding, and strict input.

Reflected XSS Vulnerability Mitigation in Forgot Password portal_type parameter (15726)

• • Fixed a reflected Cross-Site Scripting (XSS) vulnerability in the Forgot Password flow by adding server-side input validation, output encoding, and client-side sanitization for the portal_type parameter to prevent execution of malicious inline scripts.

---

Infrastructure Updates

No infrastructure updates included in this release.

---

Bug Fixes

• Resolved incorrect cookie domain capture in the Cookie Scanner (16357)
• Fixed an issue where a deep scan could get stuck and block subsequent scans from being initiated (16517)
• Resolved an issue where certain clients were unable to add new cookie domains or mobile consent apps due to missing organization configuration (16562)
• Fixed an issue where the Verification Success page content displayed to consumers after request verification did not reflect the message configured in Custom Content (16532)
• Resolved an intermittent issue where consumers encountered security warning messages when accessing the Consumer portal. (16535)

 

---

Hot Fixes Version-9.5.0

• Assessment owners now receive an email notification containing the assessment name, type, and a direct link to the assessment whenever they are newly assigned to a DSAR or any other assessment type. (16546)
• Increased the maximum character limit for discussion comments from 3,000 to 7,000 characters, enabling users to provide more detailed and comprehensive discussion entries. (16544)

 

---

Upcoming Features

Multiple Data Subject Requests Using the Same Email Address
Support to submit multiple data subject requests using the same email address, with dedicated information fields, DOB collection, and clear data subject identification across request and task detail views.

Consent Audit Trail Enhancements
Logging GPC opt out events and consolidating cookie plugin consent save and audit log operations into a single atomic API call.

View Assigned Groups for Cookie Domains in Consent Module
Support for an ‘Assigned Groups’ column in the Consent > Domain tab, empowering users to seamlessly identify which groups hold permissions for each cookie domain directly from the domain list

Remove Assigned Groups from Cookie Domains 
Support for removing Assigned Groups from Cookie Domains on the Consent > Domain tab, empowering users to effortlessly revoke group permissions and maintain precise control over domain access.