Aktualnie kod ładujący custom_accesstable pozwala co oznacza, że phpui.custom_accesstable ma zawierać:
1) ścieżkę bezwzględną
2) ścieżkę względem LIB_DIR
3) nazwę pliku w LIB_DIR

O ile także widzę, to ładowanie custom_accesstable jest już po $access->appendPermission. Proponuje więc następującą zmianę:
@@ -164,19 +164,20 @@
        ),
 );

-$access = AccessRights::getInstance();
-foreach ($access_table as $name => $permission)
-       $access->appendPermission(new Permission($name, $permission['label'],
-               array_key_exists('allow_regexp', $permission) ? $permission['allow_regexp'] : null,
-               array_key_exists('deny_regexp', $permission) ? $permission['deny_regexp'] : null)
-       );
-
 // read user-defined access rights table
 $custom_access_table = ConfigHelper::getConfig('phpui.custom_accesstable');
 if (!is_null($custom_access_table))
-       if (is_readable($custom_access_table) && ($custom_access_table[0] == DIRECTORY_SEPARATOR))
+       if (is_readable(SYS_DIR . DIRECTORY_SEPARATOR . $custom_access_table))
+               @include_once(SYS_DIR . DIRECTORY_SEPARATOR . $custom_access_table);
+       else if (is_readable($custom_access_table) && ($custom_access_table[0] == DIRECTORY_SEPARATOR))
                @include_once($custom_access_table);
        else if (is_readable(LIB_DIR . DIRECTORY_SEPARATOR . $custom_access_table))
                @include_once(LIB_DIR . DIRECTORY_SEPARATOR . $custom_access_table);

+$access = AccessRights::getInstance();
+foreach ($access_table as $name => $permission)
+       $access->appendPermission(new Permission($name, $permission['label'],
+               array_key_exists('allow_regexp', $permission) ? $permission['allow_regexp'] : null,
+               array_key_exists('deny_regexp', $permission) ? $permission['deny_regexp'] : null)
+       );
 ?>