# Suggested messages possibly bypassing see-permissions?

**URL:** <https://meta.discourse.org/t/suggested-messages-possibly-bypassing-see-permissions/149650>\
**Category:** Product Support\
**Created:** [April 28, 2020, 6:02pm UTC](https://meta.discourse.org/t/suggested-messages-possibly-bypassing-see-permissions/149650 "2020-04-28T18:02:47Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![gh\_irina](https://avatars.discourse-cdn.com/v4/letter/g/838e76/32.png) [@gh\_irina](https://meta.discourse.org/u/gh_irina)\
**Post date:** [May 2, 2020, 5:51am UTC](https://meta.discourse.org/t/suggested-messages-possibly-bypassing-see-permissions/149650/6 "2020-05-02T05:51:47Z")

</div>

Thank you, it is reassuring to hear that it is in fact possible, and not just my imagination.

However the lack of restriction on suggested messages seems like at best a breach of user trust and at worst a vulnerability. Even as admin, I shouldn’t be getting suggested _private_ messages that aren’t for me and don’t @mention me. What is the reasoning behind allowing this? Does it only apply to staff accounts, or can all our users have other people’s private messages suggested to them?

---

_[View the full topic](https://meta.discourse.org/t/suggested-messages-possibly-bypassing-see-permissions/149650)._