# User staged into topic received notifications of responses to that topic
**URL:** https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078
**Category:** Support
**Tags:** staged-users
**Created:** [12 maart 2020 om 15:48 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078 "2020-03-12T15:48:48Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@k4rtik](https://meta.discourse.org/u/k4rtik)
#### Post date: [12 maart 2020 om 15:48 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/1 "2020-03-12T15:48:48Z")
Here are the steps that happened in sequence that led me to discover this issue:
- A user in a group forwarded an email to a private category (whose access is controlled by that group) from someone who is not on our discourse.
- Because I have the “forwarded emails behaviour” setting set to “create replies”, a new topic was created automatically with OP by a new staged user (also created automatically) and a response post by the group member, both from the single email that the member sent.
- Above steps are as expected, but this step is not: the staged user was sent a “user\_replied” type email automatically with the contents of the reply post on the topic! This results in leak of information.
The staged user is not a member of the group and hence should not be sent emails from anything in the private category (even though they are owner of the topic/OP).
---
### Author:  [@maiki](https://meta.discourse.org/u/maiki)
#### Post date: [13 maart 2020 om 17:49 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/2 "2020-03-13T17:49:52Z")
I think this is covered in the settings under your group at `manage/interaction`:
> Posting
>
> Who can @mention this group?
>
> Who can message this group?
The workflow you described is intentional, and likely used more widely; we use it as a group inbox/support channel, which requires staged users (non-forum folks, like customers) to be able to email in to a private group used by internal support people.
If I were you I’d look at the `forwarded emails behaviour` setting. You maybe want “quote” or “hide”, depending on what your group is for. 🙂
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [13 maart 2020 om 18:03 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/3 "2020-03-13T18:03:11Z")
I don’t think the group settings are a factor here. The email is created as a PM and the email settings have expanded the audience of the message to the group PLUS the staged user.
As the user is part of the PM audience they will receive emails related to that PM topic.
Groups are just one type of recipient for a private message. They aren’t a container or a boundary for it’s distribution.
---
### Author:  [@k4rtik](https://meta.discourse.org/u/k4rtik)
#### Post date: [13 maart 2020 om 18:05 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/4 "2020-03-13T18:05:20Z")
Oh I notice a confusion here, which is my fault. This is not a group PM.
This was in a topic created in a category that only a particular group members can access. Let me update the op as well.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [13 maart 2020 om 18:06 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/5 "2020-03-13T18:06:28Z")
Staged users don’t need permission to access a category, they will always have access to topics that they are staged into. If you forward an email into a category and the above settings are enabled they will behave like staged users within that topic.
This is how many discourse-based support communities work. They rely on this feature.
It’s working as intended, no information leaked you just weren’t aware of the implications of these settings.
---
### Author:  [@k4rtik](https://meta.discourse.org/u/k4rtik)
#### Post date: [13 maart 2020 om 18:11 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/6 "2020-03-13T18:11:25Z")
Ah. Assuming all of this is intended, how do I now make sure that the staged user does not receive emails for further replies in that topic?
Do I need to delete the user?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [13 maart 2020 om 18:12 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/7 "2020-03-13T18:12:58Z")
If you delete the user you can anonymize their posts but that doesn’t stop a recurrence.
You can solve for the future by disabling the email parsing, disabling staged users, or educating your users not to do this unless they intend on the above outcome.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [6 maart 2024 om 06:12 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/8 "2024-03-06T06:12:23Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [6 maart 2024 om 08:14 UTC](https://meta.discourse.org/t/user-staged-into-topic-received-notifications-of-responses-to-that-topic/144078/9 "2024-03-06T08:14:44Z")