In code.opensuse.org (running Pagure 5.13.2), I'm seeing an issue where users in a group added as ticket in a project are not able to see private tickets.
I'm not sure how this is happening, though. For me, I see them just fine since I own the project in question.
You need at least commit level to see private tickets (the logic being: you need to be able to fix/commit the patch to access security sensitive tickets)
I'm not sure that makes sense, but okay, I guess?