Yes, we are using Paypal and we do have the API credentials configured. We've been able to process a refund from the CB Subs backend and in cases where users cancel their subscription, it does seem to cancel the Paypal subscription also.
The issue seems to only occur on upgrades/downgrades.
Re: "It's best when dealing with auto recurring to not allow them to upgrade unless their current subscription is inactive so they'd need to manually cancel first."
The CB Subs backend states that this is the specific reason why the API credentials are needed, which as I stated, we have configured.
From CB Subs Payment Gateway config:
"PayPal API is optional and only needed if: ...
You wish that users can cancel auto-recurring Paypal payments subscriptions from within CBSubs, and that CBSubs unsubscribes automatically autorecurring payments in case of plan upgrades. Otherwise a manual unsubscribe at paypal.com by the user is needed. "