For some context, we have a few users on our Cloud site on a client project that was initially set up. The client has access to this project. They also have their own Jira cloud site where the team has been working on. We don't have site admin access to the client's Jira site.
Months later, some product settings have also been customized. For instance, the default user group jira-users have been removed from all our projects so that totally new users don't automatically and accidentally get access to restricted projects. I think someone was also able to set it up so that new Jira users do not get added to any Jira user groups by default.
This week, I added a new Jira user to our site. They hadn't logged in and were not in any user groups. The next day, the lead on the aforementioned client project informed us that the new member got added to the client Jira site.
The project lead got an email informing them that "{the new Jira user) has joined (client Jira site name)" and that they had access to Jira and Confluence.
We checked our Jira site and this new user still hadn't even logged in to our site and was not on any user groups.
How is this even possible? How do we prevent this from happening?
