bug in user access