Steps to reproduce:

1. Create two user in Confluence:
   1. User1
   2. User2
2. Create a space - remove group permissions, and ensure two users can access the space
3. Add User 2 as a watcher for the space home page. Add a comment to the page, and verify user 2 gets a notification in their workbox.
4. Now, remove user 2 from space permissions, add another comment to the page, and see if user 2 gets another notification in their workbox.

Expected Behavior:

User 2 shouldn't get notification while he/she doesn't have permission on that space.

Actual Behavior:

User 2 is getting notification in the workbox.

Workaround 1:

Space admin can go through the individual pages and remove the user 2 from the manage watchers:
Watch > Manage Watchers
It's good if that space doesn't have many pages.

Workaround 2:

Step 1: Check if following query has a result:

SELECT n.notificationid, n.contentid, n.spaceid, um.username, c.title, s.spacename, s.spacekey
FROM notifications n
JOIN user_mapping um on n.username = um.user_key
JOIN content c on n.contentid = c.contentid
JOIN spaces s on c.spaceid = s.spaceid
WHERE um.username = 'user_name'
AND s.spacename = 'space_name'

Step 2: If the above query has a result then run following query:

DELETE FROM notifications 
WHERE notificationid in (
        SELECT n.notificationid
        FROM notifications n
        JOIN user_mapping um on n.username = um.user_key
        JOIN content c on n.contentid = c.contentid
        JOIN spaces s on c.spaceid = s.spaceid
        WHERE um.username = 'user_name'
        AND s.spacename = 'space_name'
)

Please replace user_name and space_name to affected user name and space name.

Please prepare a full database backup prior to run above queries against your database