# Non admin has access to closed category **URL:** \ **Category:** Feature\ **Created:** [2015年十二月17日 18:09 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851 "2015-12-17T18:09:09Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![AlexBCodecademy](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@AlexBCodecademy](https://meta.discourse.org/u/AlexBCodecademy)\ **Post date:** [2015年十二月17日 18:09 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/1 "2015-12-17T18:09:09Z")
So I have a closed category for our forum moderators. A non moderator was able to comment on a thread in our category that’s locked. I looked at the category permissions and confirmed he does not meet any of those, check this users badges, groups and user level - nothing! I am super confused. I impersonated him and was able to see the closed thread with direct link, see below: ![](https://global.discourse-cdn.com/meta/original/3X/6/1/61a66f04efd7fecca72b8f7cb441cb77b8febaa8.png) He can’t see the category - that’s not showing up, but I am wondering how he got here? Thank you. ---
**Author:** ![AlexBCodecademy](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@AlexBCodecademy](https://meta.discourse.org/u/AlexBCodecademy)\ **Post date:** [2015年十二月17日 18:09 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/2 "2015-12-17T18:09:44Z")
You can’t see it, but he was able to view and comment! ---
**Author:** ![AlexBCodecademy](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@AlexBCodecademy](https://meta.discourse.org/u/AlexBCodecademy)\ **Post date:** [2015年十二月17日 18:11 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/3 "2015-12-17T18:11:37Z")
Seems anyone with the direct link can see it! WITHOUT being logged in!? ![](https://global.discourse-cdn.com/meta/original/3X/4/9/49ff0ea1c49b5d6de58ac3be7c940bafd493a915.png) ---
**Author:** ![AlexBCodecademy](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@AlexBCodecademy](https://meta.discourse.org/u/AlexBCodecademy)\ **Post date:** [2015年十二月17日 18:14 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/4 "2015-12-17T18:14:20Z")
Ok – so found the problem. Maybe this is a bug? That post was under a child category in a private parent category. But when I created the child category within the private parent category, it did not keep the permissions. ---
**Author:** ![AlexBCodecademy](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@AlexBCodecademy](https://meta.discourse.org/u/AlexBCodecademy)\ **Post date:** [2015年十二月17日 18:17 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/5 "2015-12-17T18:17:03Z")
I am still wondering also, how he found it. The category was not listed in the drop down for him…(when it was “everyone” can see/reply..) ---
**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\ **Post date:** [2015年十二月17日 18:29 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/6 "2015-12-17T18:29:53Z")
> [@AlexBCodecademy](#): > > Maybe this is a bug? That post was under a child category in a private parent category. But when I created the child category within the private parent category, it did not keep the permissions. This is intended behavior – permissions do not inherit. (I don’t like that – I’d prefer it if the permissions of subcategories were always at least as restrictive as the parent category.) > [@AlexBCodecademy](#): > > I am still wondering also, how he found it. The category was not listed in the drop down for him…(when it was “everyone” can see/reply..) He could have received a link to the topic, or maybe he has guessed the topic ID? ---
**Author:** ![AlexBCodecademy](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@AlexBCodecademy](https://meta.discourse.org/u/AlexBCodecademy)\ **Post date:** [2015年十二月17日 18:44 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/7 "2015-12-17T18:44:45Z")
> [@fefrei](#): > > I’d prefer it if the permissions of subcategories were always at least as restrictive as the parent category.) +1 on that! I totally agree. Yeah, not sure on the second one either…Thanks! ---
**Author:** ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)\ **Post date:** [2015年十二月17日 18:47 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/8 "2015-12-17T18:47:42Z")
I would agree, but only if the permissions _default_ to that level. I would want the ability to override the permissions to make them less restrictive if I wanted to. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2015年十二月17日 21:25 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/9 "2015-12-17T21:25:33Z")
There is no inheritance of category permissions in Discourse. ---
**Author:** ![chapoi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/chapoi/32/537252_2.png) [@chapoi](https://meta.discourse.org/u/chapoi)\ **Post date:** [2025年十二月4日 11:37 UTC](https://meta.discourse.org/t/non-admin-has-access-to-closed-category/36851/10 "2025-12-04T11:37:11Z")