No way to restrict Event Information Visibility

Dear all,

when using CiviCRM with Drupal you can grant user roles the Drupal-Permission "CiviEvent: View Event info". To my understanding this permission should grant or deny access to event information pages such as civicrm/event/info?id=8&reset=1 (and all the event's data e.g. in custom fields).

However, it does not influence the visibility of events at all - even anonymous user (who don't have the permission "CiviEvent: View Event info") can always view the event information pages.

I could not reproduce this on the official demo as I am not able to view or change the drupal permissions there but I am having this issue on a number of installations.

In addition, even if I un-select "public event" in an event settings page the event information is still accessible. I was able to reproduce this on the official demo.

As a result there seems to be no way to restrict the access to event information.

For me, this looks like a bug - but maybe I am missing something? Any Feedback would be appreciated.

Regards
Fabian