Private accounts can still be followed without validation by other local accounts

It's my first report here so i'm sorry if i do anything wrong, i searched for a similar issue but did not find anything relevant to my case.

So here's the thing : Someone on my instance has a private account, someone else on the instance also has their account set to private, when one tries to follow the other the whole validation step is just skipped and they can both see followers-only posts from each other. I created accounts on the instance to test this and can confirm it happens every time i retry, even with my main account. There's nothing in the journalctl on the server and no other error message.