Check the permission schemes. By default JIRA gives anyone who can logon permissions to do everything and see everything. I suggest converting to project roles and removing all groups, or at least the logon related groups, from all permissions.
If you've already deleted the logon-related groups look for another group with permissions.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.