Media library security settings working on QA but not Production

Intended functionality: Secured PDFs should only be accessible by users with privilege level set to "none" and role set to "member" (as well as by users with privilege level set to "Global Administrator").

The issue: Client found that secured PDFs are accessible by all users, regardless of role. This issue is only found on the Production site, not on the QA site.

Here is what we know:

• Media library security settings are identical between QA and Production.
• Role settings are identical between QA and Production.
• Test user accounts are set to privilege level "None" and role "member".
• Individual PDFs have no security on them

Testing: This functionality is working on QA but not on production.

On QA: User clicks on a secured PDF. User is redirected to the login page. If user signs in with an account with the role "member" login is authenticated and PDF is displayed. If account does not have role "member", user remained on the login page and PDF access is denied.

On Production: User clicks on a secured PDF. User is redireced to the login page. No matter the account role, user will gain access to the PDF after logging in.

Screenshot: Media Library Security Settings

Kentico Support Resources we've used:

• Limit Access to media libraries - Our media library security settings are set up as suggested (see above screenshot)
• Permission checking in Kentico media libraries not working - Our test user accounts have privilege levels set to "none" and URLs produced by QA and Production are identical.