Pangolin Dashboard needs access control #1116

New Issue

MrUnknownDE · 2026-04-05T18:19:18+02:00

MrUnknownDE commented

2026-04-05 18:19:18 +02:00

Originally created by @JRud52 on 8/5/2025

Currently if you have a Pangolin instance and you have users added, all those users also have access to the Pangolin dashboard. They also have the ability to create a new org, and once a new org is created, they can do anything that the server admin can do. They can create their own sites, and point them to IPs/ports that are not exposed in Pangolin in the other org yet. If you are using a wildcard DNS record, this could lead to your private non internet exposed services exposed to the internet without your knowledge. The solution to this is to allow server admins to restrict who has access to the Pangolin Dashboard, or just restrict the ability to create a new org to server admin users.

*Originally created by @JRud52 on 8/5/2025* Currently if you have a Pangolin instance and you have users added, all those users also have access to the Pangolin dashboard. They also have the ability to create a new org, and once a new org is created, they can do anything that the server admin can do. They can create their own sites, and point them to IPs/ports that are not exposed in Pangolin in the other org yet. If you are using a wildcard DNS record, this could lead to your private non internet exposed services exposed to the internet without your knowledge. The solution to this is to allow server admins to restrict who has access to the Pangolin Dashboard, or just restrict the ability to create a new org to server admin users.

MrUnknownDE closed this issue

2026-04-05 18:19:18 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1116