I have got a query about Custom Metadata Types. I've created a Custom Metadata Type 'X' and using it inside a package(Doing a query from 'X'). But, I didn't give the 'Enabled Custom Metadata Type Access' from the profile for a specific user. However, that user can actually access the Custom Metadata 'X' from that package. Why is that? Why is he getting the access?

No permission was given for that user

1 Answer 1


There are few settings around this:-

  1. Restrict access to custom metadata types Allow access only through granted permissions and when accessing custom metadata types in system mode, for example, from Apex.

enter image description here

Read more here:- Control Read Access to Custom Metadata Types

  1. Protection and Privacy Options for Custom Metadata Types For sensitive data, like application secrets, it’s important that custom metadata types are included in a managed package. When contained in a managed package and set to protected or package protected, they’re not visible to subscribing organizations, making it a good place to store certain kinds of secrets.
  2. Behavior of Apex, Visualforce, and Aura Functionality that runs in system mode, such as Apex, is not affected by the Restrict access to custom metadata types org preference. Also, the with sharing modifier in the Apex class, doesn’t affect query behavior such as, isAccessible() and isCreatable(). If a field value is retrieved in Apex and assigned to a non-sObject variable, the behavior is the same whether the preference is enabled or not. When functionality is run in user mode, such as Visualforce Components, Visualforce Email templates, and Aura, you must have permission to access the custom metadata types. For example, without permission, the fields on Visualforce pages that you don't have access to aren’t displayed. The $Setup global variable (available in Visualforce and formulas) continues to load values by direct reference (meaning, data that is assigned to an sObject type) regardless of the running user.
  • Thank you for your support and prompt help. Could you please answer my query? I'm still confused.
    – Mehedi
    May 29, 2021 at 5:39
  • I will ask you two questions- what is the Visibility level of the custom metadata type in package? how users are accessing your custom metadata? May 29, 2021 at 5:52
  • Not sure about the visibility level. User is creating a record, and upon creation a trigger is fired. In that trigger Custom Metadata is value is checked. Though user wasn't given access from the profile, still he is not facing any errors.
    – Mehedi
    May 29, 2021 at 6:13
  • Could you please say how to check Visibility level from the package?
    – Mehedi
    May 29, 2021 at 6:19
  • 1
    Triggers runs in system mode, custom metadata is accessible.(Functionality that runs in system mode, such as Apex, is not affected by the Restrict access to custom metadata types org preference), hence even if they do not have access, code will work fine May 29, 2021 at 6:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .