Visitors and members get an app server error "403 Not Autorized" when viewing another user's profile.

As a visitor, try and view any user's profile (By clicking on their name or avatar). e.g.- http://current.dev.curriki.org/xwiki/bin/view/MyCurriki/Profile?user=XWiki.Dharpine

As a non-admin member (e.g. demo/curriki), you can view your own profile, but no other member's (e.g. no one can view a public member profile).

Admin user's however, can see all ass they should.

What is interesting is that it displays a SJAS 403 rather then an XWiki right violation/redirect or something.

This is the server error for SJAS:

HTTP Status 403 - Not authorized.

type Status report

messageNot authorized.

descriptionAccess to the specified resource (Not authorized.) has been forbidden.
Sun Java System Application Server 9.1_02