On October 28, 2026, Dolphin {anty} described two bugs in its weekly fixes update involving profile transfers between accounts. The first allowed extra users to retain access to a transferred profile. The second allowed the profile to be modified through the API while the transfer was awaiting confirmation.
The first bug: when a profile was transferred from a shared folder, it remained there and continued to grant access to the folder’s members. They could see and launch the profile, while the new owner saw users with access whom they had never authorized. Now, once a transfer is accepted, the profile is removed from the folder, and all folder members, including the folder owner, lose access. There is one exception: if the profile was transferred to the folder owner, it remains in the folder.
The second bug: while a transfer was awaiting confirmation (with a pending status), the profile could be modified through the API, including its name, other fields and cloud sync settings, even though the profile was locked in the interface. After accepting the transfer, the recipient received the modified profile. If sync had been disabled, the profile data was marked for deletion from the cloud. These API requests are now rejected with an error.
The company does not say how long the bugs existed or whether anyone exploited them. The post also does not say whether the fix applies to profiles transferred earlier, so it is worth checking access to those profiles.
