We bought the Charge Plugin and got it up and running for a subscription service and the website has just gone live. We just realised any new user (subscriber) has access to all other users details if they know the control panel URL!!

Charge is the only plugin ignoring user permissions in the CP. With all permissions turned off, Charge is still available in the left hand panel.

Please advise A.S.A.P.



  • Did you gave your users access to the plugin itself in the first tab? Each plugin can define custom permissions, but craft can set a default "access" permission. If you turn it off it should disappear. Of course only if they are not admins. Check your usergroup configuration, it must be a error on your site – Robin Schambach Dec 14 '17 at 16:23
  • Sorry Robin, I don't know what you mean? – Martin Dec 14 '17 at 16:27
  • please make a screenshot of your userpermissions from a user – Robin Schambach Dec 14 '17 at 16:28
  • New user view prntscr.com/hni0nk – Martin Dec 14 '17 at 16:36
  • 3
    Check your member group... I'm pretty sure it has those permissions maybe you or someone of your team included that my mistake. I can't imagine charge is giving those by default since it's a mayor security issue – Robin Schambach Dec 14 '17 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.