Fixed 2.9.0.b - unregistered users may browse private group threads

This is something I already had a problem with in one of the previous versions. This may be a misconfiguration on my part, but after upgrading from 2.8.6 to 2.9.0.b I got complaints that users who shouldn't have access may browse private groups forums and threads. They have to know the thread link and enter it manually, but it shouldn't work at all.

example link is here:

Any idea if I need to change something on my side or is it a bug?
Please fix it in 1.x also. I need at least few weeks to be ready for 2.x migration, and users are furious. Especially with gdpr fever here inEurope security of their info is hyper important. Thanks