diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index edc1d8b52..ff434890f 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "4.2.1",
+    "version": "4.2.2",
     "bin": "bin/hydrooj.js",
     "main": "src/plugin-api",
     "module": "src/plugin-api",
diff --git a/packages/hydrooj/src/handler/api.ts b/packages/hydrooj/src/handler/api.ts
index e7478d840..a40e57a2e 100644
--- a/packages/hydrooj/src/handler/api.ts
+++ b/packages/hydrooj/src/handler/api.ts
@@ -94,6 +94,8 @@ export function rebuild() {
 }
 
 class ApiHandler extends Handler {
+    noCheckPermView = true;
+
     query(q: string, variables: any) {
         return graphql({
             schema,
diff --git a/packages/hydrooj/src/handler/contest.ts b/packages/hydrooj/src/handler/contest.ts
index 6229662c3..4b2c63d7f 100644
--- a/packages/hydrooj/src/handler/contest.ts
+++ b/packages/hydrooj/src/handler/contest.ts
@@ -44,6 +44,7 @@ registerValue('Contest', [
 registerResolver(
     'Query', 'contest(id: ObjectID!)', 'Contest',
     async (arg, ctx) => {
+        ctx.checkPerm(PERM.PERM_VIEW);
         arg.id = new ObjectID(arg.id);
         ctx.tdoc = await contest.get(ctx.args.domainId, new ObjectID(arg.id));
         if (!ctx.tdoc) throw new ContestNotFoundError(ctx.args.domainId, arg.id);
diff --git a/packages/hydrooj/src/handler/problem.ts b/packages/hydrooj/src/handler/problem.ts
index b303d4ece..dc7d7e367 100644
--- a/packages/hydrooj/src/handler/problem.ts
+++ b/packages/hydrooj/src/handler/problem.ts
@@ -70,6 +70,7 @@ registerValue('Problem', [
 registerResolver(
     'Query', 'problem(id: Int, pid: String)', 'Problem',
     async (arg, ctx) => {
+        ctx.checkPerm(PERM.PERM_VIEW);
         const pdoc = await problem.get(ctx.args.domainId, arg.pid || arg.id);
         if (!pdoc) return null;
         if (pdoc.hidden) ctx.checkPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN);
@@ -83,6 +84,7 @@ registerResolver(
     },
 );
 registerResolver('Query', 'problems(ids: [Int])', '[Problem]', async (arg, ctx) => {
+    ctx.checkPerm(PERM.PERM_VIEW);
     const res = await problem.getList(ctx.args.domainId, arg.ids, ctx.user.hasPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN) || ctx.user._id,
         ctx.user.group, undefined, undefined, true);
     return Object.keys(res).map((id) => res[+id]);