I've been here before Users allocating permissions beyond their own and the only solution offered was to vote for it as a feature request, which I did. But after 7 months there have only been 10 votes for it.

I can't understand how so few people find this a problem. You need to give someone the ability to add users and put them in a suitable user group, but you then give them a free pass to increase their own access permissions and potentially reduce the access permissions for me the prime admin, this can't be acceptable for any user management system.

I need to have an administrator role that can register users and put them into suitable groups, but not let that person manage the permissions for themselves or others.

The most obvious option is to separate "assign user groups" from "assign user groups and permissions"

  • One short term solution might be to hide (via css) the Permissions tab unless you are a full admin. But I haven't got a clue where or how to do that.
    – Paul Frost
    Nov 24, 2016 at 12:37
  • Update - this has been added to Craft now. Users can't assign permissions greater than their own anymore. Dec 14, 2017 at 9:46

1 Answer 1


Non-admin users cannot change permissions for Admin users.

However, I agree with what you've said on users being able to assign groups and permissions. On practically every site I build, I need the client to be able to assign users to the groups that I created, but not be able to change a new user's permissions manually. This should definitely be separated in to two different options in the control panel.

UPDATE: In 2.6.2996 Craft added this functionality:

  • The “Assign user groups and permissions” permission has now been split into “Assign user permissions” and “Assign user groups”, and the latter now has nested permissions for each of the user groups.
  • Users with the “Assign user permissions” permission are no longer allowed to grant new permissions to user accounts that they themselves don’t already have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.