User's roles and access levels are not fully enforced