Confirming this bug, which lead to some drama on our forum. You think private topics are private, but turned out that if you click on the last reply links from a private forum, you sometimes can get in even when you don’t belong to the group. Not funny.
Also, subforums don’t inherit the settings from their parent forum.