I'd have the user try to log out, then back in and attempt (could be an issue with a value set in their cookie that isn't updated since they're already logged in); other than that, unless code can be adapted and the permission issue located, things can't go any further.