Sounds like authentication is working great, but their authorization design may be flawed.