Urgent: User Session Length Not Enforced in Server Admin/New Organization Section or or Security-Sensitive Account Settings. #621

New Issue

MrUnknownDE · 2026-04-05T17:28:05+02:00

MrUnknownDE commented

2026-04-05 17:28:05 +02:00

Originally created by @keonramses on 11/18/2025

Describe the Bug

Pangolin recently introduced a feature to enforce user session length, requiring users to re-authenticate after a configured duration.

While session enforcement works correctly for the main organization instance (user-facing UI), several critical areas continue to remain accessible even after the session has expired:

Server admin area
New organization section
Account security settings, including:
- Enabling/disabling 2FA
- Managing security keys
- Changing passwords

This results in an incomplete session timeout that leaves highly sensitive sections available without requiring re-authentication.

https://github.com/user-attachments/assets/d7836c45-a79e-4f98-b019-c99c67e3d48a

Environment

OS Type & Version: Rocky Linux 10
Pangolin Version: ee-1.12.2
Gerbil Version: 1.2.2
Traefik Version: 3.5.3
Newt Version: 1.6.0
Olm Version: N/A

To Reproduce

Enable and configure session length enforcement for the organization instance (e.g., 60 minutes).
Log in as a user who has access to:
- The organization instance
- The new organization section
- The server admin area
- Personal security settings (2FA, security keys, password change)
Wait until the configured session length has passed.
Attempt to access various pages.

Expected Behaviour

Once the configured session duration expires:

All authenticated endpoints must require re-authentication.
Access to any privileged area (admin panel, org pages, account security pages) should be revoked.
Security-sensitive pages (2FA change, password update, key management) should always enforce session freshness.

Actual Results

Access to the main organization instance is correctly blocked (forced logout).
However, without re-authenticating, the user can still access:
- New organization section
- Server admin area (all actions are accessible)
- Account security settings (2FA management, security keys, password change)

These pages continue working indefinitely, ignoring the session timeout.

*Originally created by @keonramses on 11/18/2025* ### Describe the Bug Pangolin recently introduced a feature to enforce user session length, requiring users to re-authenticate after a configured duration. While session enforcement works correctly for the main organization instance (user-facing UI), several critical areas continue to remain accessible even after the session has expired: - Server admin area - New organization section - Account security settings, including: - Enabling/disabling 2FA - Managing security keys - Changing passwords This results in an incomplete session timeout that leaves highly sensitive sections available without requiring re-authentication. https://github.com/user-attachments/assets/d7836c45-a79e-4f98-b019-c99c67e3d48a ### Environment OS Type & Version: Rocky Linux 10 Pangolin Version: ee-1.12.2 Gerbil Version: 1.2.2 Traefik Version: 3.5.3 Newt Version: 1.6.0 Olm Version: N/A ### To Reproduce 1. Enable and configure session length enforcement for the organization instance (e.g., 60 minutes). 2. Log in as a user who has access to: - The organization instance - The new organization section - The server admin area - Personal security settings (2FA, security keys, password change) 3. Wait until the configured session length has passed. 4. Attempt to access various pages. ### Expected Behaviour Once the configured session duration expires: - All authenticated endpoints must require re-authentication. - Access to any privileged area (admin panel, org pages, account security pages) should be revoked. - Security-sensitive pages (2FA change, password update, key management) should always enforce session freshness. ### Actual Results - Access to the main organization instance is correctly blocked (forced logout). - However, without re-authenticating, the user can still access: - New organization section - Server admin area (all actions are accessible) - Account security settings (2FA management, security keys, password change) These pages continue working indefinitely, ignoring the session timeout.

MrUnknownDE closed this issue

2026-04-05 17:28:05 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#621