Hi, and merry x-mas 
Currently running 0.33.6, but I’ve managed to reproduce it in 0.34.0.
I think it might be related to our collection structure. We have a collection structure looking like this:
Our analytics (no access)
_ Customer collections (no access)
__Customer A (read only)
__Customer B (read only)
_Customer A - shared (full access)
_Customer B - shared (full access)
That is the read only users have read access to collections inside a collection which they have no permissions to. We have these collections inside a parent collection due to maintenance reasons, the collections Customer A and Customer B have identical questions and dashboards, looking at different databases, which are updated via scripts. We don’t want the read only users to have access to the parent collection, as this would show them all collections inside that collection (even if they do not have any permissions for the sub collections).