diff --git a/rhodecode/tests/models/common.py b/rhodecode/tests/models/common.py
--- a/rhodecode/tests/models/common.py
+++ b/rhodecode/tests/models/common.py
@@ -1,5 +1,4 @@
-
-# Copyright (C) 2010-2023 RhodeCode GmbH
+# Copyright (C) 2010-2024 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
@@ -69,9 +68,9 @@ def _create_project_tree():
 
     """
     test_u1 = UserModel().create_or_update(
-        username=u'test_u1', password=u'qweqwe',
-        email=u'test_u1@rhodecode.org', firstname=u'test_u1',
-        lastname=u'test_u1')
+        username='test_u1', password='qweqwe',
+        email='test_u1@rhodecode.org', firstname='test_u1',
+        lastname='test_u1')
 
     fixture.create_repo_group('g0')
     g0_1 = fixture.create_repo_group('g0/g0_1')
@@ -84,8 +83,7 @@ def _create_project_tree():
     fixture.create_repo('g0/g0_2/g0_2_r2', repo_group=g0_2)
     g0_3 = fixture.create_repo_group('g0/g0_3')
     fixture.create_repo('g0/g0_3/g0_3_r1', repo_group=g0_3)
-    fixture.create_repo(
-        'g0/g0_3/g0_3_r1_private', repo_group=g0_3, repo_private=True)
+    fixture.create_repo('g0/g0_3/g0_3_r1_private', repo_group=g0_3, repo_private=True)
     return test_u1
 
 
@@ -100,14 +98,14 @@ def expected_count(group_name, objects=F
 def _check_expected_count(items, repo_items, expected):
     should_be = len(items + repo_items)
     there_are = len(expected)
-    assert should_be == there_are, (
-        '%s != %s' % ((items + repo_items), expected))
+    assert should_be == there_are, f'{(items + repo_items)} != {expected}'
 
 
-def check_tree_perms(obj_name, repo_perm, prefix, expected_perm):
-    assert repo_perm == expected_perm, (
-        'obj:`%s` got perm:`%s` should:`%s`' % (
-            obj_name, repo_perm, expected_perm))
+def check_tree_perms(obj_name, repo_perm, prefix, expected_perm, default_user=False):
+    if 'r1_private' in obj_name and default_user:
+        # private repo must be private even if "recursive" permissions apply
+        expected_perm = 'repository.none'
+    assert repo_perm == expected_perm, f'obj:`{obj_name}` got perm:`{repo_perm}` should:`{expected_perm}`'
 
 
 def _get_perms(filter_='', recursive=None, key=None, test_u1_id=None):
diff --git a/rhodecode/tests/models/test_user_permissions_on_repo_groups.py b/rhodecode/tests/models/test_user_permissions_on_repo_groups.py
--- a/rhodecode/tests/models/test_user_permissions_on_repo_groups.py
+++ b/rhodecode/tests/models/test_user_permissions_on_repo_groups.py
@@ -139,6 +139,8 @@ def test_user_permissions_on_group_with_
 
     # set permission to g0 recursive mode, all children including
     # other repos and groups should have this permission now set !
+    # except the PRIVATE repo which must remain repository.none permissions
+    # this is exclusive to the default user
     recursive = 'all'
     group = 'g0'
     default_user_id = User.get_default_user_id()
@@ -156,10 +158,10 @@ def test_user_permissions_on_group_with_
     _check_expected_count(items, repo_items, expected_count(group, True))
 
     for name, perm in repo_items:
-        check_tree_perms(name, perm, group, 'repository.write')
+        check_tree_perms(name, perm, group, 'repository.write', default_user=True)
 
     for name, perm in items:
-        check_tree_perms(name, perm, group, 'group.write')
+        check_tree_perms(name, perm, group, 'group.write', default_user=True)
 
 
 def test_user_permissions_on_group_with_recursive_mode_inner_group():