Cloudron's access wall does not replace roles inside each application

Cloudron can put an authentication layer in front of installed apps and limit access to chosen users or groups, which helps self-hosted services without their own identity integration. However, this gate only controls authentication, so the application itself still determines what an authenticated user can view or change. A group allowed through the gate may include people who should not hold administrator rights inside the app. The article recommends recording each app's access mode and group owners, then reviewing the app's own roles and the scope of any Cloudron API tokens that can alter access restrictions. It also advises testing access from non-member accounts and verifying that allowed users are not unintentionally given elevated permissions.