Hi, 

I have made my cases object private and have a custom visualforce page and controller to retrieve a list of cases.

On the standard page, a user can only see those cases they have read permissions on.

On the visualforce page, the query also retrieves cases where the case contact is also from the same account. However, the user does not actually have permission to these cases, and gets a permission error when they try to access it. 

Just for my own sanity, when you run a query it should only retrieve those objects which you have at least permission to, correct? It has been working like this for everything else I can remember. 

Is there something weird with case sharing and customer portal licenses?

I am using overage customer portal licenses in a community.