Skip to main content

Mambo 9

9.0.2​

Released on: 25 September 2026

Engine​

Fixed

  • LDAP authentication settings could not be saved: A bug caused the test user chosen while setting up LDAP authentication to always be rejected as not being a System Administrator, because the user's permissions were not read, so the settings could never be saved. The test user's permissions are now read correctly. The connection opened to check the LDAP server is also closed once the check is finished, instead of being left open.
  • SAML sign-ins ended up on the generic sign-in page once a session ended: A bug caused a session timeout, a sign-out, or a session ended by a newer sign-in to drop the tenant and the site that tell Mambo which identity provider to use, leaving anyone who signs in through SAML on a username and password form. The right sign-in page is now shown again, offering the "Sign in with SSO" option rather than returning straight to the identity provider, which would have hidden why the session ended.
  • "Sign in with SSO" link was broken when Mambo is installed under a context path: A bug caused the SAML "Sign in with SSO" link on the sign-in page, and the cookie that records which SAML sign-in path was used, to ignore the path Mambo is deployed under. On installations deployed under a path rather than at the root of the server, the link pointed at an address that does not exist. Both now include the context path, and installations at the root of the server are unaffected.
  • SAML error page linked to a broken sign-in URL for hyphenated site URLs: A bug caused the site to be read incorrectly from the SAML identifier when the site URL contains a hyphen, so the page shown after a failed SAML sign-in linked back to a sign-in address that does not exist. The tenant and the site are now split on the first hyphen only, which is the one that separates them, so site URLs containing hyphens work.

Admin Panel​

Fixed

  • KPI prize tags discarded and behaviour and reward prizes could not be removed: A bug caused the tags awarded or removed by a KPI prize to be dropped when saving the KPI, and prevented points, coupons and tags from being cleared once set on a behaviour or a reward prize. The admin panel left the emptied values out of the save request, and the engine keeps any prize field a request omits. Prize tags are now saved on KPIs, and prizes can be removed from behaviours and rewards.

9.0.1​

Released on: 24 September 2026

Engine​

Fixed

  • Renaming or deleting a custom field changed every site of the tenant: A bug caused renaming or deleting a custom field to apply across all of a tenant's sites that have a custom field with the same name, rather than only the site the custom field belongs to. Renames and deletions now only affect the site that owns the custom field.
  • Tenant usage statistics overloaded the database: A bug caused every request for tenant usage statistics (displayed in the Mambo Console for on-premise deployments) to count the records of each of the tenant's database collections. On large installations a single request was enough to saturate the database and slow down every other request. The performance of this request has now been optimized.
  • Triggering leaderboard ranking by hand failed with an internal error: A bug caused the endpoint that runs the leaderboard ranking job in the Mambo Console (available for on-premise deployments only) to fail. The underlying issue has been fixed and the endpoint now works correctly.

Security

  • LDAP directory entries were rebuilt as Java objects: While validating an LDAP server configuration, Mambo asked the directory to return the objects held in matching entries and rebuilt them inside the server, leaving a hostile or compromised directory to decide what the server constructed. Mambo requires Java 17, whose defaults refuse both to load classes from a remote location and to deserialize object data held in a directory entry, so this was not exploitable. The validation now reads only the attributes it needs, and stops as soon as it has seen enough entries to tell whether the search matched more than one user.
  • SAML login path cookie was readable by scripts: The cookie that records which login path a SAML sign-in started from is now marked HttpOnly, so scripts running in the browser can no longer read it.

Admin Panel​

Fixed

  • Caret jumped to the end of the field when typing in the campaign editor: A bug caused the caret to jump to the end of the text after every keystroke in campaign editor fields that save as you type, such as campaign title, response limits, quiz feedback bands and answer keys, custom variables and logic rules. Editing anywhere other than the end of a value was impractical. The caret now stays where you leave it.

Documentation​

Added

  • Coupon expiry and status lifecycle: The coupons documentation has been split into an overview and a dedicated page on expiry. The new page covers the difference between a coupon in your catalogue and the copy a user holds, how the expiry date is calculated and when it is set, every status each of them can have, how expiry takes effect and what it deliberately does not do, along with the webhooks involved and how to report on status.

9.0.0​

Released on: 21 September 2026

Important note: This is a major release, and it removes the twitter and facebook properties of the User object, which were deprecated in 8.0.3 with a removal date of 1st July 2025. They are no longer returned by any endpoint, and are ignored when sent. Move any values you still rely on into custom fields before upgrading. Nothing else in the API changes: everything that worked in Mambo 8 continues to work unchanged.

Engine​

Added

  • Campaigns: Campaigns are now available on every installation. A campaign collects answers from the people who use your applications and rewards them for taking part. The same campaign covers three shapes, chosen with a setting rather than built as a different kind of campaign: a survey, which collects answers, a quiz, which scores them and hands out a message and a reward per band of the total score, and a poll, which shows participants how everyone else answered. Campaigns are built from pages and questions, with twelve question types covering choices, ratings, sliders, text, dates, contact details, matrices and rankings. Conditional logic decides which pages and questions each participant sees, answers can be piped into the wording of later questions and written back onto the participant's user profile, and per-question timers and page timers keep a session moving. Distributions open the same campaign to different audiences, each with its own dates, response limits, rewards and eligibility rules, so you can run the same questions past two audiences and keep their results apart. Taking part and completing a campaign can award points and trigger behaviours, and results are counted as responses arrive rather than in a nightly batch. Participants are served through your own front end, built on the campaign APIs, whose shape may still change while the feature settles. See the Campaigns documentation.
  • Media Library: A library of images and videos, shared across all of a tenant's sites, is now available. Files can be uploaded directly or imported from a URL, and their type is identified from the content of the file rather than its name, so a mislabelled file cannot pass as something it is not. Thumbnails are generated automatically for the image formats that support them. Every asset can be named, described and tagged with keywords, and the library can be searched by keyword, file type and name. Each tenant has its own storage quota, and its usage is tracked as assets are added and removed.

Fixed

  • Database cursors were left open across the application: A bug caused many queries to leave their database cursor open after reading the records they needed, rather than closing it straight away. On busy installations these cursors accumulated and held memory and other resources on the database until they eventually timed out. Queries throughout the engine, including background jobs, now release their cursors as soon as they have finished reading.

Removed

  • twitter and facebook properties on the User object: The twitter and facebook properties of the User object, deprecated in 8.0.3, have been removed from the API and from the data model. The same information can be stored on a user with custom fields.

Admin Panel​

Added

  • Campaigns: The admin panel now has a Campaigns section. It lists your campaigns and opens each one in an editor with four sections. Content is where you build the campaign: a rail of pages and questions on the left, a preview in the middle that you edit directly, as a participant would see it, and an inspector on the right for whatever you have selected. Logic shows the campaign as a diagram of the paths a participant can take through it. Distribute manages the distributions that open the campaign to an audience. Results reports on responses, and appears once the campaign has been published. Your work saves as you go, and stays in a draft until you publish it, so a campaign that is already live only changes when you say so.
  • Media Library: The admin panel now has a Media Library section, where you upload, organise and search the images and videos your campaigns use. It also opens as a picker wherever a campaign asks for an image, so an asset can be reused rather than uploaded again.

SDKs​

Added

  • Campaigns and the Media Library in all SDKs: The Java, Node, PHP and .NET SDKs now cover the campaign and media APIs, with services for campaigns, pages, questions, distributions and sessions, and for media assets.

Documentation​

Added

  • Campaigns documentation: The documentation now covers campaigns end to end: building a campaign, question types, logic, variables and answer piping, quizzes, timers, response limits, identification, distributions, publishing and results.

Fixed

  • Broken download link for the latest version of the SDKs: A bug caused the download links for the latest version of the SDKs to point at a location that does not hold them, so the download failed. Every SDK download, for the latest version and for previous ones, now comes from versions.mambo.io.