diff --git a/frappe/core/doctype/user/user.json b/frappe/core/doctype/user/user.json
index d6f9c13cbe..025658122d 100644
--- a/frappe/core/doctype/user/user.json
+++ b/frappe/core/doctype/user/user.json
@@ -604,7 +604,7 @@
    "unique": 1
   },
   {
-   "description": "<a href=\"https://docs.frappe.io/framework/user/en/api/rest#1-token-based-authentication\" target=\"_blank\">\n  Click here to learn about token-based authentication\n</a>",
+   "description": "<a href=\"https://docs.frappe.io/framework/user/en/api/rest#1-token-based-authentication\" target=\"_blank\" rel=\"noopener noreferrer\">\n  Click here to learn about token-based authentication\n</a>",
    "fieldname": "generate_keys",
    "fieldtype": "Button",
    "label": "Generate Keys",
@@ -801,7 +801,8 @@
    "default": "1",
    "fieldname": "bulk_actions",
    "fieldtype": "Check",
-   "label": "Bulk Actions"
+   "label": "Bulk Actions",
+   "permlevel": 1
   },
   {
    "default": "1",
@@ -910,7 +911,7 @@
   }
  ],
  "make_attachments_public": 1,
- "modified": "2026-01-12 16:04:21.542524",
+ "modified": "2026-02-20 19:47:59.211390",
  "modified_by": "Administrator",
  "module": "Core",
  "name": "User",