What's New in CISO Assistant — Week 45, 2026 (v4.1.3 – v4.1.5)

This post covers v4.1.3 (October 17), v4.1.4 and v4.1.5 (both October 24). v4.1.3 is a patch that landed after last week’s post, with fixes and a new Dominican Republic regulation. v4.1.4 is the large one: tiering moves down from vendors to their solutions, spreadsheets can be imported through a mapping wizard, labels reach most assessments, and mail can go out through Microsoft Graph. v4.1.5 follows the same day with the last part of the Brotli fix and faster user actions on large instances. There is no breaking change.

Security: the Brotli Fix

v4.1.4 fixes every exploitable path of the Brotli decoder vulnerability (CVE-2026-111497) in CISO Assistant, and v4.1.5 also updates a system copy of the library that container scanners flag (PR #5172). Self-hosted instances should upgrade to v4.1.5; SaaS instances are already up to date. Our dedicated post explains the flaw, the affected paths and what to do if you cannot upgrade right away.

Third-Party Risk: Solution Tiering

Last week’s vendor tiering now reaches the solutions vendors provide (PR #5111).

• Solution tiers are set by hand or by an assessment, and record their source, date, notes and history. A new solution-tiering quick form rates a solution’s inherent risk.
• Propagation to vendors is configurable: off, suggest only, or raise the vendor’s tier automatically so it is never lower than its most critical solution. The solution page shows the recommended floor, and users with the right permission can apply it.
• Solution tiers are available in quick forms, filters, batch actions and detail views. Importing solutions no longer changes vendor tiers by accident.
• Questionnaire compliance on entity assessments — the compliance split and global score of the linked questionnaire now appear on the entity assessment page and on the TPRM overview cards. An assessment without a questionnaire shows as absent, not as zero. The TPRM overview endpoint also drops from N+1 queries to 22 (PR #5127).

Thanks to @ab-smith and @Mohamed-Hacene.

Spreadsheet Import Wizard (Experimental)

A new wizard imports CSV and Excel files whose columns don’t match our templates (PR #5119).

• Analyse the sheet, then map its headers to fields and its values to ours, set defaults and resolve conflicts.
• A dry run is required before every import, and shows the preview, warnings and detailed results.
• Mappings can be saved and reused for the next file.
• Metrics, audits, tasks, risks and related records are supported, with templates and role-based access.

Labels Everywhere

Labels now apply to risk and compliance assessments, quantitative risk studies, EBIOS RM studies, business impact analyses, threat models and entity assessments, and you can filter on them. A dedicated view lists each label with its usage count and the records that carry it, finds unused, rarely used or similarly named labels, and merges duplicates into the one you keep (PR #5152).

Privacy: Import from CNIL PIA

DPIA studies can be imported from a CNIL PIA JSON export into a draft DPIA, using one of your assessment forms. Answers, risk evaluations and matching controls are applied, and the import summary lists what could not be matched. An existing DPIA draft is flagged instead of starting a second import (PR #5151).

Mail over Microsoft Graph

A third mail transport sends mail over HTTPS through Microsoft Graph. It covers the two cases SMTP can’t: Microsoft 365 tenants that disable SMTP AUTH, and networks whose only way out is an HTTP proxy. Set EMAIL_TRANSPORT=graph with EMAIL_GRAPH_TENANT_ID, the existing EMAIL_OAUTH2_CLIENT_ID and EMAIL_OAUTH2_CLIENT_SECRET, and the mailbox in EMAIL_HOST_USER. It works as a rescue transport too, and a token failure fails over like a refused SMTP connection (PR #5153). Thanks to @nas-tabchiche.

Integrations and Automation

• n8n — the custom node is rebuilt as a scoped package covering most objects (controls, risks, tasks, assets, incidents and more), with create, get, list, update and lookup operations, pagination, credential testing, TLS settings and evidence uploads. It is being prepared for submission to n8n (PRs #5122, #5132, #5135).
• MCP — new update_folder, update_user and update_evidence tools to rename domains, edit users and move evidence to another domain. They are hidden in the read-only profile (PR #5131). Thanks to @JohnGanem.
• API documentation is now inlined in the GitBook docs (PR #5156), the ServiceNow guide covers asset sync (PR #5123), and an OCSF sample documents log forwarding (PR #5136).

EBIOS RM

The study description, a fundamental step of the method, is now more prominent in the study and its detail view (PR #5117, thanks to @tchoumi313). The report gets its missing columns back (PR #5107) and ref_id generation is consistent across the study (PR #5159).

Deployment and Operations

• Failed migrations stop startup — the upgrade used to carry on after a migration error, leaving an incomplete database. It now stops with the error. A failure to store the built-in libraries only logs a warning (PR #5102).
• Faster user actions — seat counting made some user actions slow on large instances. They stay fluid in a load test with 10,000 users and 1,000 domains (PR #5170). Thanks to @eric-intuitem.
• Helm persists uploaded files by default (PR #5120), thanks to @Claquetteuuuh.
• Search engines — responses now tell robots not to index pages or follow links (PR #5164).

Framework & Library Updates

• Dominican Republic — JM 181101-02, the cybersecurity and information security regulation (PR #5098), and R-CNMV-2024-08-MV, the securities market cybersecurity regulation (PR #5110). Thanks to @GIOSDQ.
• ISO/IEC 27090:2026 — the outline of the new standard on AI security (PR #5150).
• Mapping views and previews read the frameworks field correctly (PR #5094).

Bug Fixes

• SAML account linking — once the email mapping was edited in the SSO settings, SAML logins no longer linked the account. Those users were treated as local accounts, logged out when they opened their profile, and the page failed with “Could not get personal access tokens”. The account is now linked on login, and affected users are fixed on their next SSO login (PR #5145). SAML requests also send a default RelayState (PR #5147).
• Task filters — the “Next occurrence status” filter missed one-time tasks dated in the past, so most completed and every late one-time task dropped out. It now matches its column. A new Overdue filter finds tasks with a pending or in-progress occurrence past its due date, and the old date filter is labelled “Start date” (PR #5090). Thanks to @nas-tabchiche.
• 401 errors no longer appear for inactive browser tabs (PR #5115).
• Applied controls — the evidence filter works again (PR #5113).
• Smaller fixes: ref_id kept when duplicating a risk assessment (PR #5099) and read as text on import (PR #5114), a ref_id filter for risk scenarios (PR #5108), the optional Mailer tab on Enterprise (PR #5103), an entity list crash on malformed legal identifiers (PR #5104), consistent solution sorting (PR #5105), no sort offered on computed progress columns (PR #5050, thanks to @Claquetteuuuh), the observation column on the users list (PR #5141), and baseline readers can view classification levels (PR #5154).

Localisation

Hungarian is complete and proofread (PR #5134), thanks to @aafeher, and a pass recovers important strings in other languages (PR #5116).

For full details, see the v4.1.3, v4.1.4 and v4.1.5 release notes on GitHub.