SHSelfHostIndex
SY

sysPass

Web-based password manager for teams and businesses

Password Managers ★ 994 stars Medium setup GPL-3.0

sysPass is a self-hosted, web-based password manager written in PHP with AES-256 encrypted storage. It supports multi-user access with profiles and permissions, LDAP integration, audit history, and an API for organizations sharing credentials.

Official siteSource code

Key features

  • Role-based access control
  • Audit logging
  • LDAP integration
  • Folder organization

Pros & cons

Strengths

  • Good for organizations
  • Detailed access control

Trade-offs

  • Interface feels dated
  • Requires careful hardening

Is sysPass secure?

9 known vulnerabilities affect sysPass's latest release (3.2.11) according to OSV.dev; the most severe is rated high.

Affecting 3.2.11

AdvisorySeveritySummary
CVE-2026-65709HighsysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API
CVE-2026-63725HighsysPass FileBackupService Authenticated OS Command Injection via Backup Path
CVE-2026-65708HighsysPass 3.2.11 Insecure Direct Object Reference via AccountFileController
CVE-2026-65711HighsysPass 3.2.11 Authenticated OS Command Injection via Backup Path
CVE-2025-25477HighA host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser.
CVE-2026-65710HighsysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
CVE-2025-25478MediumThe account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames.
CVE-2024-42904MediumA cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientC...
CVE-2025-25476MediumA stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a n...
  • Most recent fixed advisory CVE-2022-4930, published 2023-03-06 (1318 days ago)

Source: OSV.dev, checked 2026-10-14. How this is measured.

sysPass replaces

Self-hosted 1Password Teams alternativesSelf-hosted Keeper alternatives

Health badge

Maintain sysPass? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 11 · at risk

Markdown
[![SelfHostIndex health score for sysPass](https://selfhostindex.com/badge/syspass.svg)](https://selfhostindex.com/app/syspass/)
HTML
<a href="https://selfhostindex.com/app/syspass/"><img src="https://selfhostindex.com/badge/syspass.svg" alt="SelfHostIndex health score for sysPass"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/syspass.svg
   :alt: SelfHostIndex health score for sysPass
   :target: https://selfhostindex.com/app/syspass/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Similar password managers apps