Giving this one a bump as I can still repro here on meta with https://meta.discourse.org/c/support/6
Is this a small security issue?
For instance, if you had a parent support category for your customers (each with their own private subcategory that the other customers couldn’t see), they could get a sneaky peek at a list of who your other customers are by using this trick.