Custom Role Issues

Ask the community
, , ,
1

Completely broken Custom Role permissions in Wix Bookings. Is anyone else dealing with this?

I honestly don’t know what else to do because Wix Customer Care has been one of the worst support experiences I’ve ever had.

I’ve spent weeks reporting what I believe is a serious privacy and permissions bug in Wix Bookings. Every reply takes days, weeks, or I don’t get a reply at all. Every response comes from a different support agent who clearly hasn’t read the previous conversation, so I have to explain the exact same issue over and over again.

Today’s response, after waiting another 2 days, was:

“We can’t investigate because nobody is assigned to that role.”

Seriously?

The entire reason nobody is assigned to that role is because the role doesn’t work. And at no point did anyone tell me I needed to assign someone before they could reproduce the issue.

Here’s the actual bug.

I created a Custom Role for my staff.

This is ALL I want this role to do:

  • Add people to bookings. So I selected Manage Bookings’ Calendar (Limited Access), which Wix describes as allowing staff to manage participants without access to customers’ phone numbers, email addresses, or home addresses. This is exactly the permission I wanted for my staff.

  • And later on I decided I would want them to create and complete POS orders, and also reply to customer messages in the Inbox. This is when I found out that the first role was not even working. This staff member had literally access to EVERYTHING. I found out the hard way because secretly sessions were added to customers’ profiles without my knowing.

This is what I DID NOT want them to access:

  • Customer phone numbers.

  • Customer email addresses.

  • Customer addresses.

  • My entire Contacts list.

  • Subscriptions.

  • Adding or removing sessions from subscriptions.

  • Changing membership plans or credits.

And ALL OF THIS WAS INCLUDED, while the role specifically says NO ACCESS TO customer phone numbers, email addresses, and home addresses.

Wix literally has permissions called Manage Bookings’ Calendar (Limited Access) and View Subscriptions, which suggest this setup should be possible.

What actually happens instead

Bug #1 — Limited Access doesn’t work.

It literally gives access to EVERYTHING.

Because Wix never answered my support tickets, I started testing different permission combinations myself to try and fix it.

Eventually I found a combination where staff no longer had access to customer contacts… but then they couldn’t book anyone into a class at all.

Instead, Wix shows this error:

“Couldn’t create order. Participant was added, but there was a problem creating the order.”

The participant gets added, but the order is never created or redeemed. We then have to go back and manually rebook customers and fix orders afterwards.

This is a core booking function. It should be treated as a critical bug and fixed immediately.

Bug #2 — The workaround exposes ALL customer contacts.

The only way I found to make booking work again was enabling another permission.

The moment I do that, staff suddenly have access to every customer’s contact information — names, phone numbers, email addresses, home addresses… everything.

That completely contradicts the description of Manage Bookings’ Calendar (Limited Access), which literally says they should not have access to that information.

Bug #3 — “View Subscriptions” still allows editing.

This is even worse.

When I only give staff View Subscriptions access.

I do NOT give Manage Subscriptions, right?

Yet they can still:

  • Edit subscriptions.

  • Add sessions.

  • Remove sessions.

  • Change membership plans.

  • Modify credits.

Why is someone able to manage subscriptions when I explicitly did not grant that permission?

If I only selected View, why does Wix give them Edit access?

That completely defeats the purpose of a Custom Role.

Bug #4 — No notifications, no audit trail, no automation.

If a staff member changes a subscription,for example changing Sessions Left from 10 to 20—I receive:

  • No notification.

  • No email.

  • No alert.

  • No audit trail.

Even worse, there is no option for me to create an automation for this either.

That means someone can modify subscriptions without the business owner ever knowing it happened.

This is incredibly prone to misuse, whether intentional or accidental.

And I’ve already experienced this in my own business.

A staff member was able to change customer subscriptions without my knowledge. We eventually had to let this person go, but this should never have been possible in the first place, because I never gave that permission in the role.

The whole Custom Role system contradicts itself.

The entire point of Custom Roles is that business owners can customize exactly what staff members can and cannot do.

Instead, permissions override each other, descriptions don’t match the actual behavior, and selecting one permission silently grants access to things I explicitly did not allow.

How is that a secure permission system?

I’m also incredibly disappointed with Wix Support.

I’ve sent screenshots, videos, screen recordings, and detailed explanations for weeks.

Instead of actually investigating the permission conflict, I keep getting template responses explaining what the different roles are—as if I don’t already know. I’m using Custom Roles. The problem is that the permissions don’t behave as documented.

Meanwhile, Wix has plenty of time to send emails about new Shop features, AI assistants, AI Twins, and all kinds of new releases.

Honestly, I don’t need more half-finished features. I’d much rather Wix fix the existing platform, resolve these bugs, and make permissions work exactly as they’re described.

A booking platform should get privacy, permissions, and subscriptions right before adding more AI features.

Is anyone else experiencing this?

  • Do your Custom Roles also ignore subscription permissions?

  • Can your staff edit subscriptions even when they only have View Subscriptions?

  • Have you found a workaround that actually protects customer privacy?

  • Or has anyone moved to another booking platform because of these permission issues and poor customer support?

At this point, I’m genuinely questioning whether Wix is the right platform for a business if basic permissions and customer privacy cannot be trusted.

2

@SYDW, that matches what other Bookings users have reported. The Limited Access calendar role leaking into contacts and subscriptions is way more than the permission description promises.

A couple things that might actually help while you’re waiting on support.

For the audit trail gap (bug #4), you can build your own with Velo. Put a beforeUpdate/afterUpdate data hook on the Bookings/Pricing Plans collection that writes old value, new value, editor id and timestamp to a log collection, then fire yourself an email or webhook whenever a session count or plan changes. Won’t fix the permission itself, but at least you’d know the moment it happens instead of finding out weeks later.

On the permission conflict, since View Subscriptions is granting edit and the calendar Limited Access role is granting full contact access, that really does sound like the backend permission checks aren’t matching what the role editor shows, not something you’re misconfiguring. Worth filing it specifically through Contact Support’s “Report a bug” flow instead of general chat, that routes to engineering instead of tier 1. Include the exact permission combo plus what the staff account actually ended up able to see as repro steps, that’s usually what gets bugs like this taken seriously.

Until it’s actually patched, the safest move is to keep anything touching subscriptions on Owner/Admin only and route staff requests through you manually. Not a real fix, but it closes the privacy hole you’re describing.

3

Thank you so much for taking the time to reply. Honestly, this is the first response I’ve received where someone actually understands what I’m trying to explain.

The scary part is that this isn’t just an audit trail issue anymore, it’s the permissions themselves. I’ve spent weeks testing different combinations of Custom Roles, and the behavior simply doesn’t match what Wix says those permissions do.

I’ve already sent Wix screenshots, screen recordings, and exact reproduction steps, and they’ve had this case for weeks. Instead of escalating it, I keep getting passed between support agents who ask me to explain everything again.

I really appreciate the Velo suggestion, and I’ll definitely look into it as a temporary workaround. But I honestly don’t think business owners should have to build custom audit logs to compensate for permission settings that don’t work as documented. This should work out of the box, especially when it involves customer privacy and memberships.

At this point, I’m mostly trying to figure out whether this is a known Wix issue or whether I should seriously start looking at another platform that offers proper staff permissions and better support. Have you seen Wix actually acknowledge or fix this for anyone, or is it still an open issue for other users too?

4

I’m trying to build exactly what you described, but I’m clearly missing a step. Would you mind explaining it to me?

What I want is very simple:

  • Every time anything changes in a Wix Pricing Plan / Subscription (sessions added, sessions removed, subscription activated, suspended, renewed, etc.), I want a new row added to my CMS.
  • I want it to log at least: customer email, action, old value, new value (if sessions changed), who made the change, and the timestamp.

Would you mind walking me through it step by step?

  1. Where does the beforeUpdate / afterUpdate hook go?
  2. Which collection is it attached to? (I can’t find a normal CMS collection for Pricing Plans Orders.)
  3. What is the exact code you would use?
  4. How do you get the previous and new session count into the log?

I’d really appreciate an exact walkthrough because Wix documentation hasn’t been helpful, and Support keeps sending me in circles. Thank you so much!

5

Good questions, and I need to correct something from my earlier reply: Pricing Plans orders and Bookings sessions are NOT regular CMS collections, so there is no beforeUpdate/afterUpdate hook to attach to them. That’s exactly why you couldn’t find one in the Content Manager dropdown, you were right to get stuck there. The actual mechanism is event handlers from the dedicated SDK modules, not wix-data hooks.

  1. Where it goes: any backend .js file (does not need to be named events.js or be tied to a page), e.g. backend/planEvents.js.
  2. Which “collection”: there isn’t one to attach to. You create your own CMS collection (e.g. ChangeLog) and write to it yourself from inside the event handler.
  3. Rough shape of the code, using the current SDK:

import { orders } from ‘@wix/pricing-plans’;

import { bookings } from ‘@wix/bookings’;

import { items } from ‘@wix/data’;

orders.onOrderPurchased((event) => logChange(event, ‘purchased’));

orders.onOrderEnded((event) => logChange(event, ‘ended’));

bookings.onBookingCreated((event) => logChange(event, ‘session_used’));

bookings.onBookingCanceled((event) => logChange(event, ‘session_freed’));

async function logChange(event, action) {

await items.insert(‘ChangeLog’, {

action,
    timestamp: new Date(),
    raw: event
  });
}

4. Old vs new session count: the event payload gives you the new state, not a diff. To get "old value / new value" the way you want it, read your own last logged row for that order/customer before inserting the new one, and put the previous number in old_value yourself.

Honest caveat since this affects customer privacy for you: I have not run this exact combination end to end on a live site. Before you build the schema around it, log event.raw for a few real test changes and check the actual field names in the console, Wix has changed some Pricing Plans event shapes between API versions, and I do not want to send you chasing a field name that is not there.