diff --git a/pos_refund_password/doc/RELEASE_NOTES.md b/pos_refund_password/doc/RELEASE_NOTES.md
index a4d344ef5..9f0d7ee45 100644
--- a/pos_refund_password/doc/RELEASE_NOTES.md
+++ b/pos_refund_password/doc/RELEASE_NOTES.md
@@ -4,11 +4,18 @@
 #### Version 16.0.1.0.0
 #### ADD
 - Initial commit for pos_refund_password odoo
+
 #### 28.03.2023
 #### Version 16.0.1.0.1
 #### FIX
 - Fixed the undeclared body 
-- #### 06.09.2023
+
+#### 06.09.2023
 #### Version 16.0.1.0.2
 #### FIX
 - Fixed the refund password issue
+
+#### 28.03.2024
+#### Version 16.0.1.0.3
+#### FIX
+- Fixed the access right issue.
\ No newline at end of file
diff --git a/pos_refund_password/model/refund_password.py b/pos_refund_password/model/refund_password.py
index 04f83fb3a..4e7735d42 100644
--- a/pos_refund_password/model/refund_password.py
+++ b/pos_refund_password/model/refund_password.py
@@ -19,7 +19,7 @@
 #    If not, see <http://www.gnu.org/licenses/>.
 #
 ###############################################################################
-from odoo import models, fields
+from odoo import models, fields, api
 
 
 class PosConfig(models.Model):
@@ -36,3 +36,9 @@ class ResConfigSettings(models.TransientModel):
     global_refund_security = fields.Integer(
         string='Global Refund Security',
         config_parameter='pos_refund_password.global_refund_security')
+
+    @api.model
+    def get_value(self):
+        security_password = self.env['ir.config_parameter'].sudo().get_param(
+            'pos_refund_password.global_refund_security')
+        return security_password
diff --git a/pos_refund_password/static/src/js/refund_password.js b/pos_refund_password/static/src/js/refund_password.js
index 45b297a15..7bbe42f0c 100644
--- a/pos_refund_password/static/src/js/refund_password.js
+++ b/pos_refund_password/static/src/js/refund_password.js
@@ -13,9 +13,9 @@ odoo.define('pos_refund_password.RefundPasswordButton', function (require) {
             var refund="";
             var session_refund= false;
             var data = await rpc.query({
-                model: 'ir.config_parameter',
-                method: 'get_param',
-                args:["pos_refund_password.global_refund_security"],
+                model: 'res.config.settings',
+                method: 'get_value',
+                args:[],
             })
             .then(result =>{
                 refund = result;