Sugar Serve 14.0.3 Release Notes

Overview

This document describes the changes and functionality available in Sugar 14.0.3. Sugar 14.0.3 is only available for customers on the annual upgrade path.

Note: This release is not available for SugarCloud customers.

Fixed Issues

Sugar 14.0.3 is a security update released to address certain security vulnerabilities identified during our routine QA checks.

For customers on the annual upgrade path, we strongly recommend that you install this update at the earliest opportunity. While we have not experienced any reported incidents relating to these vulnerabilities to date, failure to install this update could leave you exposed to malicious third-party attacks. For more information, please refer to the following Security Advisory announcements:

Security Advisory sugarcrm-sa-2025-029: Authenticated administrators could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-030: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-031: Authenticated administrators could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-032: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-033: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-034: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-035: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-036: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-037: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-038: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-039: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-040: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-041: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-042: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-043: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-044: Authenticated administrators could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-045: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-046: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-047: Any user could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-048: Any user could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-049: Any user could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-050: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-051: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-052: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-053: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-054: Authenticated administrators could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-055: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-056: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-057: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-058: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-059: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-060: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-061: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-062: Authenticated administrators could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-063: Any user could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.
Security Advisory sugarcrm-sa-2025-064: Authenticated users could cause arbitrary code to be executed. This has been fixed to prevent arbitrary code from being executed.

These vulnerabilities have been addressed in release 14.0.3, which is available for download from the Download Manager.

Administrators are strongly encouraged to upgrade their on-site Sugar instances running 14.0.2 or lower to version 14.0.3 to prevent potential exploitation of these weaknesses.

The following issues have been resolved in this release. Case portal users can use the following links for more details about each issue:

97329: Regular users encountered a permissions error when merging records (e.g., quotes) with a Doc Merge template containing a currency field. We have addressed this so that users can now merge records with templates containing currency fields.
93121: The "Auto Increment Next Value" for the AutoIncrement field incorrectly reverted back to "1" in Admin > Studio even though a new value (e.g., 100) was set for the field. This has been fixed so that the "Auto Increment Next Value" displays the correct value to be applied to a record.

Known Issues

Click the link below to expand or collapse the 14.0.3 known issues list.

14.0.3 Known Issues

The following known issues are present in this release. Case Portal users can use the following links for more details about each issue:

96663: In certain circumstances, the email text may get cut off improperly when viewing the message in a module's record view (e.g., Emails, Cases). As a workaround, copy the text (e.g., CMD+A) and paste into a text editor to see the entire message.
96559: When using doc merge with quotes, the numbered line items for quotes may not display correctly in the merged document.
96140: When converting a lead that has the same name as an existing contact in Sugar, users may experience some unexpected issues on the Convert Lead page.
95066: In certain circumstances, attempting to delete a group user in Sugar may fail and display an error.
94903: In certain circumstances, upgrading Sugar may fail with an error.
94746: Filtering the Leads list view using the My Leads filter does not return the correct results as expected.
94707: Modifying the dropdown field (e.g., Sales Stage) value's item name may cause unexpected issues to occur in the module's (e.g., Opportunities) tile view. For information on the workaround, refer to the issue's description in the case portal.
94515: Fields in the user record (e.g., Locale Settings) are cleared in the UI after linking a role to the user via the Roles subpanel and are then cleared from the database if the record is saved. As a workaround, refresh the page after adding a role to a user via the Roles subpanel or do not click "Save" at the top of the record view.
94436: When a Group User is modified in Sugar, the changes do not save as expected.
94395: When a dashboard template with dashboard filters is duplicated, the dashboard filters do not control the Report dashlets as expected. As a workaround, re-create the dashboard filters on the duplicated dashboard.
94245: Drilling through report charts may not work as expected and display "No data available" if the report is grouped by a relate field.
94136: Double clicking on a record's row in the subpanel of a custom module does not open the inline editing mode as expected.
94110: Merging a record containing a JPEG image using the "Doc Merge to PDF" option may not work as expected and result in an error.
93906: User tags do not display properly with the correct border, font color, etc. in comment logs.
93792: When attempting to inline edit a multiselect or tag field in the related-record subpanel or list view, the input fieldmay not appear in the correct location.
93648: In certain circumstances, the Timeline dashlet may fail to load with a persistent Loading message causing unexpected issues with the navigation bar.
93631: When new panels are added to the record view layout while configuring the dropdown-field-based views in Studio, changing the panel label may improperly update the label of the other new panels.
93515: The mail server status continues to display "Authorized" in Admin > System Email Settings even though outbound emails may fail to send when the email settings is configured to use Google mail via OAuth2.
93359: In certain circumstances, installing packages via Admin > Module Loader may fail due to an Elasticsearch error.
93076: For instances that have Activity Stream enabled, attempting to access the Home page activity stream may not load as expected.
92477: DateTime fields may be calculated incorrectly in reports when accounting for daylight savings time (DST).
92217: The texts in the Product Catalog dashlet may not display properly making it hard to read.
92063: When campaign test emails are sent, users may notice unexpected issues with certain subpanels in the module (e.g., Accounts) that the campaign emails are related to.
91861: In certain circumstances, subpanels in Sugar may not behave as expected or not be configurable in Admin > Studio.
91283: Filtering the Emails list view using the From field does not return the appropriate results as expected.
90931: When role permissions are modified for a user, the changes do not get applied until the browser cache is cleared and the user logs out and back in to their account.
90615: When logged into Sugar using a non-English language (e.g., French), changing the classification value for the sales_stage_dom list in Admin > Dropdown Editor may improperly change the classification values for the other list items. As a workaround, log in to Sugar with the English (US) language and manually update the classification of the list items to the correct values.
89878: The Forecast Bar Chart dashlet in the Forecasts module does not display any data for individual sellers.
89728: In certain circumstances, opening the list view Mass Actions menu does not display properly on the screen.
89542: For instances wth a very large number of SugarBPM processes, trying to view the list of processes in the Process Management's list view may result in performance issues and fail to load.
88957: In certain circumstances, performing a global search in Sugar may result in a 500 error.
88374: Attempting to reorder the columns in the Worksheet Columns Preview list view in Admin > Quotes Configuration does not work as expected. As a workaround, remove all the fields from the Worksheet Columns section then add the fields again to the section.
86285: In certain circumstances, users may experience unexpected behaviors when attempting to expand a subpanel or edit an empty Subpanel layout in Admin > Studio. For information on the workaround, refer to the issue's description in the case portal.
85246: Errors may get logged in the system after upgrading or installing Sugar when certain license data is missing.
84426: The Meeting Type field in the Meetings module does not reflect new values added to the Meeting Type dropdown list in Admin > Dropdown Editor.
81382: Deleting a target list related to a large number of records may fail with an error.
79009: When the targeted module contains a broken field, configuring an Action element in a process definition causes the Process Design canvas to time out.
77719: If a process definition contains a Wait event that is relative to a date field, the process does not adjust for changes that may occur to the date field after the Wait event's initiation.
77287: Performing certain actions (e.g., import, mass update) in Sugar may result in performance issues if there are numerous calculated fields to be updated in related records. As a workaround, add the following line to the config_override.php file to disable the related calculation field updates: $sugar_config['disable_related_calc_fields'] = true;. But keep in mind that the affected calculated values will not be updated and running Recalculate Values on related records.
77249: Guests may not get imported to call or meeting records as expected.
68112: Matrix-type reports may display incorrectly when exported to PDF.

Supported Platforms

For information on supported platform components, see Sugar 14.0.x Supported Platforms.