Permissions in Liferay come through roles, not user groups (though it might be indirectly through UGs)

So: Check the roles that your users have. Also, note that there are site- and organization-specific roles, that might give you some permissions in one area but not in the other.

And last: If it's a custom portlet, no author is bound to Liferay's way of permission handling. they might have implemented permission checks themselves instead of delegating to Liferay's permission handler. In that case you'll have to analyze the portlet's sourcecode.