The group membership lists for some users is sometimes losing some groups when some of the groups are nested. For example, a user customertest2 is a member of the group customer-test, which is a member of the group customer. Once the issue happens, the groups will show up as:

customertest2 (String) [jira-users, customer-test] (ArrayList)

but they should be:

customertest2 (String) [jira-users, customer-test, sdk-customer, customer] (ArrayList)

Diagnostic steps: Check to see if flushing the cache on the client (e.g. Confluence Admin Console -> Cache Statistics -> Flush All) fixes the problem temporarily.

This membership error is cached in the com.atlassian.crowd.integration-all-memberships cache.

Workarounds:
We have still not been able to find the source of the problem within the confluence code, however we do know that someone the confluence caches are affecting the crowd caches.

We have attached the crowd-integration-client-2.0.7-CWD-1996.jar which shades net.sf.ehcache to com.atlassian.crowd.shaded.ehcache. What this means is that there is no possible way that Confluence could have any effect whatsoever with the Crowd integration client's caches. They are essentially different classes that Confluence knows nothing about.

To apply the patch, upgrade to crowd 2.0.7 and in your confluence instance, remove the any other Crowd integration client JARs from
CONFLUENCE_INSTALL/confluence/WEB-INF/lib
and place the attached crowd-integration-client-2.0.7-CWD-1996.jar and restart confluence.