Permissions to view booking-contact

To follow up, I was even able to delete someone else's booking.

Thanks for finding this, luckily this is easy for you to fix on your end. All of those listing pages are Views and you can edit them and change the "Access" setting to be Permission based and set it to the "Access Booking Contact Overview Page" or whatever role or permission you want that's not viewable to everyone.

I pushed up new configs into dev, but those will not import for people who already have the module installed.

Automatically closed - issue fixed for 2 weeks with no activity.