# Sudden realization about issue with Ticket System (private topics plugin)
**URL:** https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252
**Category:** Support
**Created:** [April 8, 2026, 7:59pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252 "2026-04-08T19:59:37Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@tknospdr](https://meta.discourse.org/u/tknospdr)
#### Post date: [April 8, 2026, 7:59pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/1 "2026-04-08T19:59:37Z")
We have successfully been using Discourse as our ticketing system for several months now. All has been going smoothly but I just realized that there is a security issue that I overlooked as it was hidden through obscurity until just now.
Everything has been going fine with the exception that I had to add trust\_level\_0 to our ticket topic in order for regular users to be able to create topics via e-mail (works fine without it for staged users)
As the forum itself was mostly dead I didn’t notice until just yesterday that when users with trust level 0 log in they can see posts from our support category even though it’s set up as a private topic and supposed to only be visible to admins and our ‘support\_staff’ group.
Is there a way to fix this? If not I’ll have to scrap this whole project as we have a lot of personal/sensitive info in the support tickets.
Thanks!
David
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [April 8, 2026, 8:26pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/2 "2026-04-08T20:26:38Z")
This is _exactly_ why we developed [Private Topics Plugin](https://meta.discourse.org/t/private-topics-plugin/268646)
---
### Author:  [@tknospdr](https://meta.discourse.org/u/tknospdr)
#### Post date: [April 8, 2026, 8:29pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/3 "2026-04-08T20:29:12Z")
I’m using that, and it doesn’t seem to be working.
> [@tknospdr](#):
>
> even though it’s set up as a private topic and supposed to only be visible to admins and our ‘support\_staff’ group.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [April 8, 2026, 9:01pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/4 "2026-04-08T21:01:00Z")
Can you please share your forum URL in a PM to me, together with a screenshot of the Category → Security tab of that category?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [April 8, 2026, 9:12pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/5 "2026-04-08T21:12:10Z")
> [@tknospdr](#):
>
> they can see posts from our support category even though it’s set up as a private topic
What do you mean by “private topic”?
We have “personal messages” but there’s no such concept as a “private topic”.
BTW, how you describe things working is exactly how we use meta itself. Emails to our support address come into personal messages in a group inbox - there’s no leakage to the public.
I think you have things set up wrong.
---
### Author:  [@tknospdr](https://meta.discourse.org/u/tknospdr)
#### Post date: [April 8, 2026, 9:28pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/6 "2026-04-08T21:28:18Z")
> [@supermathie](#):
>
> We have “personal messages” but there’s no such concept as a “private topic”.
Please scan up, there is a plug in literally called Private Topics, and that’s what I’m using.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [April 8, 2026, 9:30pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/7 "2026-04-08T21:30:05Z")
Ah, OK, you should add that information to the OP.
---
### Author:  [@tknospdr](https://meta.discourse.org/u/tknospdr)
#### Post date: [April 8, 2026, 9:31pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/8 "2026-04-08T21:31:54Z")
PM sent.
---
### Author:  [@tknospdr](https://meta.discourse.org/u/tknospdr)
#### Post date: [April 8, 2026, 11:40pm UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/10 "2026-04-08T23:40:41Z")
Issue resolved. We did a PR on my brain and now everything is working.
I misunderstood a setting in the plugin’s settings. Once I was schooled, everything works like it should.
Thanks!
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [April 9, 2026, 12:56am UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/11 "2026-04-09T00:56:17Z")
Explaining the mix-up would make this topic useful to future readers.
With the current amount of detail all we know is “something was wrong and is now fixed”.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [April 9, 2026, 7:16am UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/12 "2026-04-09T07:16:25Z")
The Private Topics plugin was installed.
Two things were going on:
- all topics were somehow created by the `support_staff` group and not by the individual users
- the setting “Private topics permitted groups” (_Always show topics started by a member of these groups_) included that `support_staff` group.
Hence, all topics were visible for all TL0 users.
When `support_staff` was removed from “Private topics permitted groups” everything worked as intended.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 9, 2026, 7:16am UTC](https://meta.discourse.org/t/sudden-realization-about-issue-with-ticket-system-private-topics-plugin/400252/13 "2026-05-09T07:16:55Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.