closes #1922

src/database/mongo/sets.js

@@ -57,7 +57,7 @@ module.exports = function(db, module) {
 			}
 
 			values = values.map(function(value) {
-				return items.members.indexOf(value) !== -1;
+				return items && Array.isArray(items.members) && items.members.indexOf(value) !== -1;
 			});
 
 			callback(null, values);

src/privileges/helpers.js

@@ -80,6 +80,9 @@ function isGuestAllowedTo(privilege, cids, callback) {
 		userPrivilegeExists: function(next) {
 			groups.exists(userKeys, next);
 		},
+		groupPrivilegeExists: function(next) {
+			groups.exists(groupKeys, next);
+		},
 		hasGroupPrivilege: function(next) {
 			groups.isMemberOfGroups('guests', groupKeys, next);
 		}
@@ -90,7 +93,10 @@ function isGuestAllowedTo(privilege, cids, callback) {
 
 		var result = [];
 		for (var i = 0; i<cids.length; ++i) {
-			var groupPriv = privilege !== 'find' && privilege !== 'read' ? results.hasGroupPrivilege[i] === true : results.hasGroupPrivilege[i] !== false;
+			var groupPriv = (privilege === 'find' || privilege === 'read') ?
+				(!results.groupPrivilegeExists[i] || results.hasGroupPrivilege[i] !== false) :
+				(results.groupPrivilegeExists[i] || results.hasGroupPrivilege[i] === true);
+
 			result.push(!results.userPrivilegeExists[i] && groupPriv);
 		}