It sounds like a privacy issue, especially when the User datatype involved. Please check these and maybe expand privacy rules of User.
User