I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources.
I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited.
Environment
OS Type & Version: Debian Trixie
Pangolin Version: 1.15.4
Gerbil Version: 1.3.0
Traefik Version: 3.6.8
Newt Version: 1.9.1
To Reproduce
Create a new user.
Log in as the new user.
Navigate to Organizations -> Create New Organization
Add a site (local or any)
Add resources
Log out
Log in as admin
Click on the Organizations drop-down
Verify the newly created organization is not shown
Expected Behavior
I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.
Originally created by @macdaddybighorn on GitHub (Feb 23, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2520
### Describe the Bug
I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources.
I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited.
### Environment
- OS Type & Version: Debian Trixie
- Pangolin Version: 1.15.4
- Gerbil Version: 1.3.0
- Traefik Version: 3.6.8
- Newt Version: 1.9.1
### To Reproduce
Create a new user.
Log in as the new user.
Navigate to Organizations -> Create New Organization
Add a site (local or any)
Add resources
Log out
Log in as admin
Click on the Organizations drop-down
Verify the newly created organization is not shown
### Expected Behavior
I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.
<!-- gh-comment-id:3961721168 -->
@oschwartz10612 commented on GitHub (Feb 25, 2026):
This is intentional behavior right now. You can disable the following flag to change it.
https://docs.pangolin.net/self-host/advanced/config-file#param-disable-user-create-org
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @macdaddybighorn on GitHub (Feb 23, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2520
Describe the Bug
I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources.
I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited.
Environment
To Reproduce
Create a new user.
Log in as the new user.
Navigate to Organizations -> Create New Organization
Add a site (local or any)
Add resources
Log out
Log in as admin
Click on the Organizations drop-down
Verify the newly created organization is not shown
Expected Behavior
I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.
@oschwartz10612 commented on GitHub (Feb 25, 2026):
This is intentional behavior right now. You can disable the following flag to change it.
https://docs.pangolin.net/self-host/advanced/config-file#param-disable-user-create-org