diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 68773f9d..6b818b85 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.22.4",
+    "version": "2.22.5",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/handler/record.ts b/packages/hydrooj/src/handler/record.ts
index f3c91782..c4db31f6 100644
--- a/packages/hydrooj/src/handler/record.ts
+++ b/packages/hydrooj/src/handler/record.ts
@@ -1,5 +1,5 @@
 import { FilterQuery, ObjectID } from 'mongodb';
-import { PermissionError, RecordNotFoundError } from '../error';
+import { ContestNotFoundError, PermissionError, RecordNotFoundError } from '../error';
 import { Rdoc } from '../interface';
 import { PERM, STATUS, PRIV } from '../model/builtin';
 import * as system from '../model/system';
@@ -25,6 +25,11 @@ class RecordListHandler extends RecordHandler {
     async get(domainId: string, page = 1, pid?: string, tid?: ObjectID, uidOrName?: string, all = false) {
         this.response.template = 'record_main.html';
         const q: FilterQuery<Rdoc> = { 'contest.tid': tid, hidden: false };
+        if (tid) {
+            const tdoc = await contest.get(domainId, tid, -1);
+            if (!tdoc) throw new ContestNotFoundError(domainId, pid);
+            if (!this.canShowScoreboard(tdoc, true)) throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
+        }
         if (uidOrName) {
             let udoc = await user.getById(domainId, +uidOrName);
             if (udoc) q.uid = udoc._id;