Search result FindPayment Group shows 'Cancel trigger to user with view permission

When accessing https://localhost:8443/accounting/control/FindPaymentGroup as a user with only VIEW permissions (e.g. userId=auditor), the overview of payments found shows an action trigger to cancel a payment.