We have successfully been using Discourse as our ticketing system for several months now. All has been going smoothly but I just realized that there is a security issue that I overlooked as it was hidden through obscurity until just now. Everything has been going fine with the exception that I had to add trust_level_0 to our ticket topic in order for regular users to be able to create topics via e-mail (works fine without it for staged users) As the forum itself was mostly dead I didn’t notice until just yesterday that when users with trust level 0 log in they can see posts from our support category even though it’s set up as a private topic and supposed to only be visible to admins and our ‘support_staff’ group. Is there a way to fix this? If not I’ll have to scrap this whole project as we have a lot of personal/sensitive info in the support tickets. Thanks! David

The Private Topics plugin was installed. Two things were going on: all topics were somehow created by the support_staff group and not by the individual users the setting “Private topics permitted groups” (Always show topics started by a member of these groups) included that support_staff group. Hence, all topics were visible for all TL0 users. When support_staff was removed from “Private topics permitted groups” everything worked as intended.

This is exactly why we developed Private Topics Plugin

I’m using that, and it doesn’t seem to be working. [image] tknospdr: even though it’s set up as a private topic and supposed to only be visible to admins and our ‘support_staff’ group.

Can you please share your forum URL in a PM to me, together with a screenshot of the Category → Security tab of that category?

[image] tknospdr: they can see posts from our support category even though it’s set up as a private topic What do you mean by “private topic”? We have “personal messages” but there’s no such concept as a “private topic”. BTW, how you describe things working is exactly how we use meta itself. Emails to our support address come into personal messages in a group inbox - there’s no leakage to the public. I think you have things set up wrong.

[image] supermathie: We have “personal messages” but there’s no such concept as a “private topic”. Please scan up, there is a plug in literally called Private Topics, and that’s what I’m using.

Ah, OK, you should add that information to the OP.

Issue resolved. We did a PR on my brain and now everything is working. I misunderstood a setting in the plugin’s settings. Once I was schooled, everything works like it should. Thanks!

Explaining the mix-up would make this topic useful to future readers. With the current amount of detail all we know is “something was wrong and is now fixed”.

Sudden realization about issue with Ticket System (private topics plugin)

Product Support

tknospdr (David Muszynski) April 8, 2026, 8:29pm 3

I’m using that, and it doesn’t seem to be working.

Topic		Replies	Views
Private Topics Plugin Plugin	104	8088	April 22, 2026
Private Topics - are they supported? Product Support	26	11512	June 1, 2018
Is there a way to create topics so that only topic creator can see their topics? Product Support	3	262	July 23, 2025
Is it possible to have a category where users only see their own topics Product Support	6	295	December 22, 2025
Discourse ignoring Category trust_level_0 (registered user) making posts public Product Support	19	5261	July 2, 2015

Sudden realization about issue with Ticket System (private topics plugin)

Related topics