I do not know of anyway that a user could start a sprint without that explicit permission. The strange thing is that the permission to do so would have to be granted on a project level. However sprints are not bound to specific projects. Which means that a sprint can originate from a different project, and still appear on multiple boards/projects.
In those cases, in order to start the sprint, that user needs that manage sprint permission in all the projects of which the sprint contains at least 1 issue.
If you have seen this happen, I would recommend examining the sprint in question, and find at least one issue in that sprint that you are sure this user can see. From there use the Permission helper to verify if this user has the permissions needed to manage sprints here.
My thought is that this user might have that permission in another project that allows that user to do so. If that happens, and then later some other user adds issues from another project into this existing sprint, that sprint might start appearing on different boards.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.