I'm truly desperate, I have this situation: After the Critical update Spring21 on Salesforce a guest user page don't save anymore.

What I have:

  • A Site with a A Visualforce page
  • A Guest user profile
  • A custom controller
  • In the custom controller I try to update a 'CustomObject' in a Master relation with Contact.

I have done this configurations suggested on some other Forum:

  • Apex class is a 'public without sharing' Class
  • Guest user profile had access to the Account,Contact,and Custom object fields
  • Added sharing rule for guest user on Account, this because for the custom Object and Contact the sharing setting are set on 'Controlled by Parent', then i can create only a role on the top object the Account in this case
  • Added to the 'apex:inputfield' the new attribute ignoreEditPermissionForRendering="true"

When I try to save the debug log give me this message:

  • System.VisualforceException: Update access denied for 'CustomObject__c', controller action methods may not execute.

Have you a suggest? there is a way to let its work again? If not what are my option to have the same functionality?

Thanks at all

1 Answer 1


As stated in this thread can you check the mentioned solution:

It should still work if you are using Without Sharing, but it's challenging.

For input fields, you will need to add the new ignoreEditPermissionForRendering attribute on apex:inputField. This will allow you to override entity the lack of edit permission for the guest user. However, it doesn't always seem to work - e.g. Rich Text can be an issue. But if the DML is using without sharing, then you can still update the record. Note - to initially view the record, it either needs to be shared via the new sharing rules, or exposed as part of the without sharing class.

However, this won't typically work for anything that is not an inputField - anything else like select list or inputtext requires a different approach - either bind to a variable in the controller, and set the corresponding field on save, or clone the object without preserving an id, expose that on the page, and then set the id before save (if that sounds mad, it is, but it does seem to work)

I would also suggest joining the Securing Experience Cloud group on Success since there are several threads where people are trying to tackle these issues, and there are links to resources like this one that talk about different approaches you can use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .