Admin user session is kicked / loses Site permissions when accessing OSGi Plugins portlet on dotcms/dotcms:26.08.12-02_d0e7744

Problem Statement

The docker-compose.yml auto-generated by https://www.dotcms.com/docs/latest/current-releases for this release embeds a CUSTOM_STARTER_URL that resolves to a broken/incomplete path, observed literally containing the string "null" (e.g. .../starter/null/starter-null.zip). This is not an issue with the dotcms/dotcms Docker image itself; it's specific to the docker-compose.yml the releases page generates.

Two cascading symptoms were observed on a fresh docker compose up using that generated file:

1. dotCMS fails to boot entirely with "Error processing starter.zip: zip END header not found" (the URL returns a 404/error page instead of a valid zip).
2. If that broken URL is worked around (e.g. removed to fall back to the image's bundled starter), the instance boots but the Admin User ends up without READ permission on the default Site, any attempt to open the Plugins (OSGi) portlet triggers a permission exception and forces the session to log out.

Confirmed root cause and fix: swapping in the CUSTOM_STARTER_URL generated for a previous LTS release (a valid starter.zip URL) resolves both symptoms, the instance boots cleanly and the Admin User has full Site permissions, including normal Plugins portlet access. This isolates the defect to the CUSTOM_STARTER_URL value the Current Releases page generates for this specific release, not the dotCMS server/image.

Impact: anyone following the official "get started with Docker" instructions from the Current Releases page for this release hits this on first boot it fully blocks a working local instance until the URL is manually fixed.

Browser/OS: N/A reproduced via Docker Compose / dotCMS backend, not front-end specific.

Steps to Reproduce

Steps to Reproduce

1. Go to https://www.dotcms.com/docs/latest/current-releases and copy the docker-compose.yml generated for the current release (image dotcms/dotcms:26.08.12-02_d0e7744 at time of report)
2. docker compose -f docker-compose.yml up
3. Observe FATAL ERROR at startup: "Error processing starter.zip: zip END header not found" — the generated CUSTOM_STARTER_URL contains the literal string "null" (.../starter/null/starter-null.zip)
4. Workaround attempt: remove CUSTOM_STARTER_URL to fall back to the image's bundled starter → instance boots, but logging in as Admin User and opening the Plugins portlet immediately logs the session out. Logs show "User 'dotcms.org.1' does not have read permissions on 'default'" followed by a HostAPIImpl.checkSitePermission security exception and WebResource permission failures on /api/v1/osgi and /api/v1/osgi/available-plugins.
5. Confirmed fix: replace CUSTOM_STARTER_URL with the value generated for a previous LTS release → instance boots cleanly, Admin User has full Site permissions, Plugins portlet works normally.

Error log

dotcms-1      | WARNING: Use of the three-letter time zone ID "VST" is deprecated and it will be removed in a future release
dotcms-1      | 14:43:08.597  WARN  login.LoginServiceAPIFactory - User 'dotcms.org.1' does not have read permissions on 'default'
dotcms-1      | 14:43:08.598  WARN  login.LoginServiceAPIFactory - com.dotmarketing.portlets.contentlet.business.HostAPIImpl.checkSitePermission(HostAPIImpl.java:199)
dotcms-1      | 14:43:08.598  ERROR login.LoginServiceAPIFactory$LoginServiceImpl - User 'dotcms.org.1' does not have permission to any Site in the repository. Please contact your CMS Administrator.
dotcms-1      | 14:43:08.607  INFO  util.SecurityLogger - class com.dotcms.cms.login.LoginServiceAPIFactory$LoginServiceImpl : User dotcms.org.1 has successfully login from IP: 172.18.0.1 -- ip:172.18.0.1,user:Admin User [ID: dotcms.org.1][email:admin@dotcms.com]
dotcms-1      | 14:43:08.699  ERROR business.HostAPIImpl - User 'Admin User [ID: dotcms.org.1][email:admin@dotcms.com]' does not have READ permissions on Site 'default'
dotcms-1      | 14:43:08.700  INFO  util.SecurityLogger - class com.dotcms.rest.exception.mapper.DotSecurityExceptionMapper : User 'Admin User [ID: dotcms.org.1][email:admin@dotcms.com]' does not have READ permissions on Site 'default' -- ip:172.18.0.1,user:Admin User [ID: dotcms.org.1][email:admin@dotcms.com]
dotcms-1      | 14:43:08.700  WARN  mapper.DotSecurityExceptionMapper - User 'Admin User [ID: dotcms.org.1][email:admin@dotcms.com]' does not have READ permissions on Site 'default'
dotcms-1      | 14:43:15.163  WARN  rest.WebResource - InitDataObject Error: uri:/api/v1/osgi err:Admin User:admin@dotcms.com
dotcms-1      | 14:43:15.163  WARN  rest.WebResource - Admin User:admin@dotcms.com
dotcms-1      | 14:43:15.164  WARN  rest.WebResource - com.dotcms.rest.WebResource.checkPortletPermissions(WebResource.java:415)
dotcms-1      | 14:43:15.165  WARN  rest.WebResource - InitDataObject Error: uri:/api/v1/osgi/available-plugins err:Admin User:admin@dotcms.com
dotcms-1      | 14:43:15.165  WARN  rest.WebResource - Admin User:admin@dotcms.com
dotcms-1      | 14:43:15.165  WARN  rest.WebResource - com.dotcms.rest.WebResource.checkPortletPermissions(WebResource.java:415)
dotcms-1      | 14:43:15.192  INFO  login.LogoutWebInterceptor - Starting Logout --> /dotAdmin/logout
dotcms-1      | 14:43:15.192  INFO  login.LogoutWebInterceptor - Doing the logout
dotcms-1      | 14:43:15.613  INFO  util.SecurityLogger - class com.dotcms.cms.login.LogoutWebInterceptor : User Admin User (dotcms.org.1) has logged out from IP: 172.18.0.1 -- ip:172.18.0.1,user:Admin User [ID: dotcms.org.1][email:admin@dotcms.com]
dotcms-1      | 14:43:15.620  INFO  login.LogoutWebInterceptor - Logout DONE

https://github.com/user-attachments/assets/3200d1c1-6bb9-4fad-b2b0-0fd6f6227359

Acceptance Criteria

Acceptance Criteria

• The docker-compose.yml generated by the Current Releases page for this release contains a working CUSTOM_STARTER_URL (no "null" placeholder)

dotCMS Version

26.08.12-02

Severity

Critical - System unusable

Links

N/A

Start by reproducing the generated docker-compose.yml from the Current Releases page for version 26.08.12-02 and inspect how CUSTOM_STARTER_URL is populated. Verify the generated URL contains no null placeholder, returns a valid starter archive, and allows docker compose up to complete with Admin access to the Plugins portlet.