I have found out and tested, that using URLs, anybody can join any group even it's private..

the join link is really simple http://yoursite.com/groups/1/join

now you can just change the number to any group number and you're joining that group!!!

If this hasn't been posted before, please consider fixing this..

Thank you ^_^