User profile not private!

I was advised to use this link for admin to view members profiles in the front end: index.php?option=com_comprofiler&task=userprofile&user=USER_ID

But I just discovered that any member with knowledge of this link can see other members profile information if they if the arbitrarily put in a number in place of USER_ID How can this be? How can i prevent this!

Might have found the answer. Please verify if this the only thing I need to do:

Under Configuration/User Profile

Allow Access To: Super Users

What you've configured is for every profile to require Super Users usergroup to access. Meaning Registered users can't even access themselves. What are you trying to do specifically? If you want this private to registered users only then set it to Registered. Other users will always be able to access other users, there's no feature to block users from viewing other users.

It looks like I can block though. I changed the setting as desribed and as long as I have an Edit or View Profile menu links I can get to my member profile with no issue. The URL is set up with Search Engine Friendly URLs so you can't see the actual long link below.

But when I punch in /index.php?option=com_comprofiler&task=userprofile&user=USER_ID, its true I can't get to my profile nor anyone elses (You are not authorized to view this page!)

Only Super Admin's seem to be able to access with this link.

So, is this normal behavior? Otherwise, I think its a problem if members can see other members confidential info like phone numbers, etc.

If you want users to control their privacy then install CB Privacy. If you want certain data private to administrators then move those fields to a tab that's in a not shown on profile position and render them with substitutions in a tab that's accessible to administrators only. Do not set profile access to Super Users and expect it to work properly, because it won't as various API won't be able to access CB if the logged in user is anyone other than Super Users and it's going to cause problems.

If you want users to control their privacy then install CB Privacy.

I saw that plugin - Is there away to have the privacy setting be on by default? This way the user would have to choose to make the information available.

...render them with substitutions...

Can you elaborate or is the info in the manual?

Do not set profile access to Super Users and expect it to work properly, because it won't as various API won't be able to access CB if the logged in user is anyone other than Super Users and it's going to cause problems.

Since the option is available in the configuration, when would the setting be useful?