Thank you very much @LeonidS for confirming the issue and creating/fixing GitHub issue #5527.

This does appear to match what we found on our side. In our testing, new content inside a closed/secret group was creating notification events with the context as the owner, for example:

owner_id = group/space profile ID

object_privacy_view = negative group/space profile ID

However, common members/followers of that context were failing the notification/privacy check, so Email/Push notifications were only reaching the admin/posting profile.

As a temporary workaround, we modified two notification-layer files:

modules/boonex/notifications/classes/BxNtfsPrivacy.php

modules/boonex/notifications/classes/BxNtfsTemplate.php

This allowed group/space followers to pass notification privacy for private context-owned notification events and allowed push payload generation. It fixed push delivery for timeline updates, comments, discussions, and discussion comments in our tests.

Your fix looks cleaner because it appears to address the root privacy check by adding a viewer-aware space/context privacy check in:

inc/classes/BxDolPrivacy.php

modules/base/profile/classes/BxBaseModProfileModule.php

Before UNA 15 Vega is released, can you please confirm whether it is safe to manually apply this two-file fix to our current UNA 14 installation? We need this feature working now, but I want to avoid applying a patch that depends on other UNA 15 changes.

Also, can you please confirm whether this fix applies to both Groups and Spaces, and whether it also applies to other similar context/profile modules that use the same closed/secret context privacy mechanism?

If we apply your official fix now, should we revert our temporary notification-layer workaround and test using only your core privacy fix?