Confluence users are able to see spaces that they do not have access to

[brian_g]

We have users who have general product access (only with group "confluence-users") to Confluence are able to see spaces that they are granted access to. 

I have verified all of the Confluence Space settings (https://[INSTANCE].atlassian.net/wiki/spaces/[PROJECT]/settings/permissions) but am not able to find a reason why

• /users (user is not there)
• /groups ("confluence-users" not there)
• /guests (user is not there)
• /anonymous (not selected)
• /public-links (not allowed)

[brian_g · Accepted solution]

I think I found the answer, and it is related to Jira Service Management (JSM) > Knowledge base. 

When a JSM project has a connected Knowledge base then by default all users who have access to Confluence (ex., default access group "confluence-users") also have access to it. 

[Daniel Khan]

Thanks! We also faced this issue today. On our side it was bug, so to solve the issue we needed to re-connect the Space to the JSM, then unlink again and it started to work as desired.

[Kristian Klima]

Hi @brian_g 

You can configure access to specific spaces per specific user (space permissions, users tab).

In other words, even if a user belongs to confluence-users, you can grant them admin rights of any space, or remove even the View permissions for any space.

(Unless I'm mistaken, confluence-users can, by default, view all spaces).

[Rilwan Ahmed]

Hi @brian_g ,

1. Check if the users are part of any other group, other than confluence-users and taht group is granted confluence access.
2. If you are using external user directory, check if any group is nested under other groups. 

[brian_g]

Hi @Rilwan Ahmed 

Thanks for your reply

1. The user only has two groups

2. The user is not synced from an external directly and was added directly to Confluence. Also, there are no nested groups  https://admin.atlassian.com/s/[...]/groups. 

The only group that is added to this space IS NOT "confluence-users" 

[Rilwan Ahmed]

Hi @brian_g 

Go to space settings --> permissions

(direct url: https://<baseURL>/wiki/spaces/spacepermissions.action?key=<SPACEKEY>

Check if the user or group is granted access to the space here