This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Log in to ask a question
Log in to ask a question

Looker Studio Viewer+ Permissions Malfunctioning (Security Breach)

Posted 2 weeks ago
biznessbizness
Bronze 3
Bronze 3
Reply posted on --/--/---- --:-- AM

I have a few dozen clients with access to the same dashboard with View only permissions, but with the "Viewer +" Meaning they should be able to create their own scheduled delivery.

However, when I am logged into a test account with "Viewer +" permissions, my only option under Share > Schedule Delivery is to EDIT or DELETE an existing schedule that is not owned by the viewer, but owned by the report owner for a *different client*!

I discovered this because one of my clients added herself to a different client's scheduled send! Thankfully, we have view permissions set up by email address, so the PDF she received was blank / errors. However, I am very concerned that the "can create scheduled send" aka can set up their own scheduled report and own it, is not as advertised and is actually revealing settings and permissions that view only users should not have access to see! This is so concerning!

My only solution for now is to remove all "Viewer +" permissions to simply "Viewer" and let all of my clients know that they have to ask me to set up their scheduled sends on their behalf.

0 3 125
0 Likes
3 REPLIES 3

Posted on --/--/---- --:-- AM
biznessbizness
Bronze 3
Bronze 3
Reply posted on --/--/---- --:-- AM

@sam8 You have been so helpful and knowledgeable with Looker Studio bugs in the past - I was wondering if you could please take a look. TLDR: I do not believe that users are able to create new schedules with the "Viewer +" level of permissions, but they instead are given access to edit or delete an existing schedule that they are not the owner of.

0 Likes

Posted on --/--/---- --:-- AM
sam8
Staff
Reply posted on --/--/---- --:-- AM

Thanks for the kind words! 

Though this probably isn't the answer you want to hear, I'm pretty sure this is intended behavior.

According to the scheduling docs:

If the report is a Looker Studio Pro report, and you are a Looker Studio Pro user, you can assign the Can create schedules permission to users and groups who have a Viewer role, even if those users are not Looker StudioPro users. This permission allows those users to create and edit schedules on the report.

I agree that letting users edit all schedules can be scary! Thankfully, as you noticed, the data source permissions kick in and prevent those users from seeing data that they shouldn't be able to see. Maybe the UI should be clearer and say "create and edit" in more places. I noticed in some places it only says "create schedules", but in others it mentions "create and edit".

I don't believe Looker Studio has a feature right now that allows users to only create their own schedules. I think this is a great idea for a feature request though!

0 Likes

Posted on --/--/---- --:-- AM
sam8
Staff
In response to sam8
Reply posted on --/--/---- --:-- AM

Oh, and I was able to reproduce the issue with the Viewer+ user not being able to create a new schedule as well. I think that is explained by the limitations of scheduling section, specifically this part:

  • If you don't have Looker Studio Pro, each report can have no more than one schedule. If you have Looker Studio Pro, each report can have up to 20 schedules.

If you upgrade that report to Pro, then I suspect that user will be able to create as well as edit.

0 Likes