This is a known limitation of CUPS.
The only workaround is to create application user and fine tune their permission by using user groups.
The reason for that is: CUPS synchorize most of the database tables from CUCM (and keep syncing). One of the exception is the "application user". So you can customize the application user without worrying them being overwritten by the synchronization.
You may submit a feature request to your account mangaer. See if the developer can enhance this in future releases.
Michael
http://htluo.blogspot.com