diff --git a/backend/app/routers/library.py b/backend/app/routers/library.py
index b406b84..4923db7 100644
--- a/backend/app/routers/library.py
+++ b/backend/app/routers/library.py
@@ -112,11 +112,14 @@ async def get_library_stats(
 
     size = (await db.execute(select(func.sum(Photo.file_size)).where(owner))).scalar() or 0
 
-    # Source root directories (active ones only).
+    # Source root directories (active ones only). Scoped to the
+    # requesting user unless they're an admin asking for global view —
+    # otherwise the Settings panel would leak other users' NC paths.
+    sr_query = select(SourceRoot.path).where(SourceRoot.is_active.is_(True))
+    if not (scope == "global" and current_user.role == "admin"):
+        sr_query = sr_query.where(SourceRoot.user_id == current_user.id)
     roots = (
-        await db.execute(
-            select(SourceRoot.path).where(SourceRoot.is_active.is_(True)).order_by(SourceRoot.path)
-        )
+        await db.execute(sr_query.order_by(SourceRoot.path))
     ).scalars().all()
 
     return {