Issue Summary

In the roadmap, users can see themes from a portfolio that they have no permission (that they do not belong).

Steps to Reproduce

Prerequisites: Jira Align environment with 2 portfolios, each with at least 1 theme created

1. Find/create a user (not super admin) who can see the roadmap and themes
2. Set the user to have permission for 1 portfolio only
3. Login as the user
4. Reset all filters on the top/tier1 configuration
5. Open the roadmap
6. Select 'Work > Themes'
7. Select 'Month by Quarter'

Expected Results

The user can see only the themes from the portfolio he/she is a member of.
(Same experience as the themes grid or the backlog view).

Actual Results

The user can see all themes from both/all portfolios.

Workaround

To workaround, this behavior you should make sure to select a program in the tier1 configuration.