<p>We bought the Charge Plugin and got it up and running for a subscription service and the website has just gone live.  We just realised any new user (subscriber) has access to all other users details if they know the control panel URL!!</p>

<p>Charge is the only plugin ignoring user permissions in the CP.  With all permissions turned off, Charge is still available in the left hand panel.</p>

<p>Please advise A.S.A.P.</p>

<p>Thanks</p>

<p>Martin</p>

CC BY-SA 3.0
2017-12-14T16:23:32.877Z
Did you gave your users access to the plugin itself in the first tab? Each plugin can define custom permissions, but craft can set a default "access" permission. If you turn it off it should disappear. Of course only if they are not admins. Check your usergroup configuration, it must be a error on your site
Robin Schambach
CC BY-SA 3.0
2017-12-14T16:27:15.520Z
Sorry Robin, I don't know what you mean?
Martin
CC BY-SA 3.0
2017-12-14T16:28:49.980Z
please make a screenshot of your userpermissions from a user
Robin Schambach
CC BY-SA 3.0
2017-12-14T16:36:33.303Z
New user view http://prntscr.com/hni0nk
Martin
CC BY-SA 3.0
2017-12-14T16:37:53.623Z
Admin permissions screen http://prntscr.com/hni1jx
Martin
CC BY-SA 3.0
2017-12-14T16:40:02.747Z
Do your users have separate permissions? Because if not they should not even be able to see the cp. They must be in multiple user groups or they have separate permissions. You can go into your user section, click on one of them and see what each user can do
Robin Schambach
CC BY-SA 3.0
2017-12-14T17:00:56.403Z
Yes, each user has access to Charge but this seems to have been automatically added? http://prntscr.com/hnicwi
Martin
CC BY-SA 3.0
2017-12-14T17:04:30.517Z
Check your member group... I'm pretty sure it has those permissions maybe you or someone of your team included that my mistake. I can't imagine charge is giving those by default since it's a mayor security issue
Robin Schambach
CC BY-SA 3.0
2017-12-14T18:17:32.177Z
Were you able to correct it? If not maybe there is a hook/event that grants those permissions. You could try to disable other plugins (in your developing environment) and check if the issue still occurs
Robin Schambach
<control-panel><permissions>
Charge Plugin - Subscribers have access to the Control Panel and any other subscribers personal information
# Charge Plugin - Subscribers have access to the Control Panel and any other subscribers personal information

(Asked by: username_0 on 2017-12-14)

We bought the Charge Plugin and got it up and running for a subscription service and the website has just gone live. We just realised any new user (subscriber) has access to all other users details if they know the control panel URL!!

Charge is the only plugin ignoring user permissions in the CP. With all permissions turned off, Charge is still available in the left hand panel.

Please advise A.S.A.P.

Thanks

username_0

**Tags:** control-panel, permissions

> **Comments:**
> **username_1**: Did you gave your users access to the plugin itself in the first tab? Each plugin can define custom permissions, but craft can set a default "access" permission. If you turn it off it should disappear. Of course only if they are not admins. Check your usergroup configuration, it must be a error on your site  
> **username_0**: Sorry Robin, I don't know what you mean?  
> **username_1**: please make a screenshot of your userpermissions from a user  
> **username_0**: New user view http://prntscr.com/hni0nk  
> **username_0**: Admin permissions screen http://prntscr.com/hni1jx  
> **username_1**: Do your users have separate permissions? Because if not they should not even be able to see the cp. They must be in multiple user groups or they have separate permissions. You can go into your user section, click on one of them and see what each user can do  
> **username_0**: Yes, each user has access to Charge but this seems to have been automatically added? http://prntscr.com/hnicwi  
> **username_1**: Check your member group... I'm pretty sure it has those permissions maybe you or someone of your team included that my mistake. I can't imagine charge is giving those by default since it's a mayor security issue  
> **username_1**: Were you able to correct it? If not maybe there is a hook/event that grants those permissions. You could try to disable other plugins (in your developing environment) and check if the issue still occurs  

---

## 0 answers

