SharePoint 2013 People and Groups

Question

Recently we have noticed that few of our customer and contractors are viewing pages which they shouldn't have access in the first place. What we have found they are inserting this particular url to the root site and all the groups and users information is accessible to everyone whoever enters information in this format.

root: www.example.com/

insert: _layouts/15/groups.aspx

www.example.com/_layouts/15/groups.aspx

Each customer and contractors have their own sub-site. Group is created for each of them "Edit" access given to them. They shouldn't have access to outside of their assigned sub-site.

Let me know if you need any further info to guide me through the fix the issue.

Answer 1

Users who have access to this site can access this list with specific URL. However, users who are not Administrators will not have the permission to modify this list.

User Information List has unique permission by default and cannot be modified via List Settings > Permissions for this list, not even when you log in as a site Administrator. Thus, there is no OOB solution to prevent users from accessing this list with the specific URL.