Why QCFUM Refuses Certain Frontend User-Management Actions

QCFUM deliberately rechecks frontend user-management requests on the server. A visible button, row, or saved setting is not sufficient authorization. Refusals protect Joomla administrative accounts and prevent stale UI state from bypassing current entitlement, ACL, scope, or action settings.

Use the returned error and the current target state to identify which gate failed instead of loosening every safeguard at once.

Global Action Gates

Every Frontend User Manager action first requires qcfum.frontend.manage_users and an active, structurally usable Max/All Access Frontend User Manager feature. The target is then loaded and must pass isFrontendManagerEditable(). A failure returns That user is not available for frontend management.

Target Scope and Protection

A user can be refused because they are outside the configured shown/editable groups, explicitly excluded, the current manager, an administrator-notification recipient, or protected through direct/inherited administrative-capability groups. QCFUM also protects targets that themselves authorize core.admin, core.login.admin, or core.manage.

Action-Specific Settings

Even an editable target can be refused when the requested operation is disabled: identity edit, password reset, require-reset, status change, group change, deletion, MFA flag, and Bulk Actions each have independent settings. Group changes additionally validate every requested target group; deletion may be converted to approval or block-first.

Current Bulk-Action Exception

In 2.0.4, Bulk Actions have an additional implementation defect: the shared action handler requires a single target_user_id before it reaches the bulk branch, while the bulk form submits only bulk_user_ids[]. That refusal is a product-code issue, not a reason to weaken the user-protection configuration.

Troubleshoot in Order

  1. Confirm Max/All Access Effective entitlement and the Frontend User Manager enablement.
  2. Confirm qcfum.frontend.manage_users for the real staff account.
  3. Check shown/editable/protected groups and explicit exclusions.
  4. Check the specific action toggle and approval setting.
  5. Retry with a deliberately safe normal-user target.

Community Discussion

Want to compare Joomla user-management workflows, share practical QCFUM tips, or discuss how other administrators use this feature? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.