Users able to create objects in folders without proper authorization