I'm using the RNG Event module in D8 and have an issue where any registered user can click on an event and has access to the view and event tabs. And then through the event tab they can access the settings, access, conflicts, etc.
They can also click to view other user's registrations and delete them.
How do I limit normal logged in users to only see the event, and to register or delete a registration for only themselves? If they can see the other registrants that's fine, but they shouldn't be able to delete.
I have checked all normal permissions settings and see nothing that could grant their current level of access. The only other thing I see under Content Type > Event type > Access Defaults are the three stock rules that also seem to be correct.
This may or may not be connected to the issue I'm having here - Why does the "Registration List" tab not appear for my events for users with adequate privileges?