On October 28, 2026, Dolphin {anty} reported two bugs in profile transfers between accounts in its weekly fixes roundup. The first left extra people with access to a transferred profile. The second let users modify a profile through the API while the transfer was waiting for confirmation.
First, when a profile was transferred from a shared folder, it stayed in the folder and continued granting access to its members. They could see and launch the profile, while the new owner saw people in the access list whom they hadn’t granted access to. Now, once the transfer is accepted, the profile is removed from the folder, and all its members, including the folder owner, lose access. There’s one exception: if the profile is transferred to the folder owner, it stays in the folder.
Second, while a transfer was waiting for confirmation (status: pending), the profile could be modified through the API—its name, other fields, and cloud sync settings—even though the interface showed it as locked. The recipient received the modified profile after accepting the transfer. If sync had been turned off, the profile data was marked for deletion from the cloud. These API requests are now rejected with an error.
The company doesn’t say how long the bugs existed or whether anyone exploited them.
What to do: Check access to profiles transferred earlier—the post doesn’t say whether the fix applies to them.
