Even thought i dont have permissions to read one topic, because the privileges where changed, i'm still getting all kind of notifications about it.
It includes e-mails, pushbullet notifications, notification alerts etc; if i try to visit the topic i get the following message, wich is correct: Access Denied
You seem to have stumbled upon a page that you do not have access to.
The use-case can be reproduced now in the following topic: https://community.nodebb.org/topic/4243/script-alert-injected-script/5 with my user permissions. I think i'm getting notifications because i've replied to the topic before the permissions were changed.