Users get access to directories they shouldn't

[NicerDicer 3]

I have a library "Series" with the directories "Shows" and "Shows.Incoming", both containing subdirectories like "Show name". Access to the Incoming directory is explicitly removed for regular users (unchecked). I put new files into "Shows.Incoming/Show name/" to check them without regular users seeing them, before later moving them over. That worked fine until recently, when files there started being accessible for regular users regardless of that removed access to anything under "Shows.Incoming".

[NicerDicer 3]

Addition: This doesn't happen with "Show name" directories that are only in "Shows.Incoming" and not in "Shows", just with files in "Show name" directories that exist in "Shows.Incoming" AND "Shows".

[Luke 42312]

Hi, and its' only in one place right?

[NicerDicer 3]

I don't know if I understand you correctly, so here's an example:

Shows/
  Show name 1/
    Episode A1
    Episode A2
Shows.Incoming/
  Show name 1/
    Episode A3
  Show name 2/
    Episode B1

• In the library, user X has the access check mark set for "Shows" and "Shows.Incoming", and correctly sees all four episode files.
• In the library, user Y only has access set for "Shows" but inside "Show name 1" sees A1, A2 and incorrectly A3, but correctly doesn't see "Show name 2" at all, and therefore also not B1.

[Neminem 1638]

Is this enabled in you library settings.

[NicerDicer 3]

@NeminemYes that's active, it's an important puzzle piece in the workflow described above. This grouping is the desired  behaviour, but it should not lead to bypassing accessibility checks for entries.

 

 

[NicerDicer 3]

On 4/12/2026 at 6:04 AM, Luke said:

its' only in one place right?

On 4/12/2026 at 4:59 PM, NicerDicer said:

I don't know if I understand you correctly

Probably: Files yes, directories no.

See my longer answer above. In its current state, this is a severe security issue. Users get access to entries they are explicitly not allowed to see.