Simple member can create their own hidden organization(s) #215

New Issue

MrUnknownDE · 2026-04-05T17:02:41+02:00

MrUnknownDE commented

2026-04-05 17:02:41 +02:00

Originally created by @macdaddybighorn on 2/23/2026

Describe the Bug

I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources.

I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited.

Environment

OS Type & Version: Debian Trixie
Pangolin Version: 1.15.4
Gerbil Version: 1.3.0
Traefik Version: 3.6.8
Newt Version: 1.9.1

To Reproduce

Create a new user.
Log in as the new user.
Navigate to Organizations -> Create New Organization
Add a site (local or any)
Add resources
Log out

Log in as admin
Click on the Organizations drop-down
Verify the newly created organization is not shown

Expected Behavior

I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.

*Originally created by @macdaddybighorn on 2/23/2026* ### Describe the Bug I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources. I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited. ### Environment - OS Type & Version: Debian Trixie - Pangolin Version: 1.15.4 - Gerbil Version: 1.3.0 - Traefik Version: 3.6.8 - Newt Version: 1.9.1 ### To Reproduce Create a new user. Log in as the new user. Navigate to Organizations -> Create New Organization Add a site (local or any) Add resources Log out Log in as admin Click on the Organizations drop-down Verify the newly created organization is not shown ### Expected Behavior I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.

MrUnknownDE closed this issue

2026-04-05 17:02:41 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#215