github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-07 13:19:07 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #2520] Simple member can create their own hidden organization(s) #8945

New Issue
Closed
opened 2026-04-30 05:05:14 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-30 05:05:14 -05:00
Owner
Copy Link

Originally created by @macdaddybighorn on GitHub (Feb 23, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2520

Describe the Bug

I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources.

I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited.

Environment

  • OS Type & Version: Debian Trixie
  • Pangolin Version: 1.15.4
  • Gerbil Version: 1.3.0
  • Traefik Version: 3.6.8
  • Newt Version: 1.9.1

To Reproduce

Create a new user.
Log in as the new user.
Navigate to Organizations -> Create New Organization
Add a site (local or any)
Add resources
Log out

Log in as admin
Click on the Organizations drop-down
Verify the newly created organization is not shown

Expected Behavior

I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.

Originally created by @macdaddybighorn on GitHub (Feb 23, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2520 ### Describe the Bug I am running the current version of Pangolin (v1.15.4) and I was playing around with Authentik and creating new users and found that any user, despite their access restrictions, can create their own organization. It can be selected from the upper-left dropdown and you can just make one, which appears to allow you to create your own resources and do pretty much everything an owner of an organization can do. When you do this, you are the only one who can see this organization also, so the admin/owner of your organization that you were a member of originally doesn't know you have this new organization with it's own sites and resources. I don't know if this is a feature that I don't quite understand, but it seems like you, as a simple member, should not have the ability to create your own shadow organization. This could also be a security risk if local sites can be opened by a simple member and possibly exploited. ### Environment - OS Type & Version: Debian Trixie - Pangolin Version: 1.15.4 - Gerbil Version: 1.3.0 - Traefik Version: 3.6.8 - Newt Version: 1.9.1 ### To Reproduce Create a new user. Log in as the new user. Navigate to Organizations -> Create New Organization Add a site (local or any) Add resources Log out Log in as admin Click on the Organizations drop-down Verify the newly created organization is not shown ### Expected Behavior I would not expect a member with no access to be able to create organizations, sites, and resources. I also would expect the admin/owner of the pangolin organizations to be able to see any organizations or resources created under the user that is a member of the organization.
GiteaMirror commented 2026-04-30 05:05:19 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Feb 25, 2026):

This is intentional behavior right now. You can disable the following flag to change it.

https://docs.pangolin.net/self-host/advanced/config-file#param-disable-user-create-org

<!-- gh-comment-id:3961721168 --> @oschwartz10612 commented on GitHub (Feb 25, 2026): This is intentional behavior right now. You can disable the following flag to change it. https://docs.pangolin.net/self-host/advanced/config-file#param-disable-user-create-org
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#8945
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?