Strapi Permission Access Issue: Users Accessing Incorrect Collections

System Information
  • Strapi Version: “4.10.7”
  • Operating System: Ubuntu 22.04.4 LTS
  • Database: MySql 2.18.1
  • Node Version: v16.20.2
  • NPM Version: v8.19.4
  • Yarn Version: 1.22.19

Hello everyone,

I’m encountering a puzzling situation with Strapi and I’d like to share my difficulty to see if anyone can help me understand what’s going on.

Recently, I joined a project that uses Strapi as its content management system. The issue arises when I try to create new user roles or even new users with different sessions. The response I get in these situations isn’t the one I expected, and it’s leaving me perplexed.

A specific example is as follows: I created a user with the “Support” role so that they could access only the “Patients” collection. However, when this user logs in, they are redirected to a different collection that isn’t “Patients”. I’ve meticulously checked the settings, and everything seems to be correct.

Furthermore, I conducted tests with other users and roles, and noticed something even stranger: even when I uncheck the option for access to “Patients”, these users can still view this collection. What’s even more confusing is that even after completely removing all permissions from the “Support” role, users with that role can still access the “Exams” collection without any issues. It seems like there’s some deeper issue that I’m failing to identify.

I’m a bit lost with this situation and I’d like to know if anyone has experienced something similar or has any idea what could be happening.