I had a user report today that they were unable to import products.

They got an access denied error for the ir.model.data model.

The permissions of this model (also verified with runbot) are that only those users in the group "Administration / Access Rights" have create access.  All users have read access.

I've always helped users import products, so have always used the admin user to do so.  

It appears this is the only user who can import products?  Or anything in fact. Is this correct?  Since it appears that the only user who can create External ID's is the admin user, that would indicate nobody else can import anything with the default permissions.