A user created a ticket in jira, which was moved to another section, where the creator of the ticket has no rights. But the creator recieved a notification in confluence about a new comment on the ticket, he was no longer able to read and the comment was quoted in confluence.

I think, this is a security flaw, because the comment should not show up in the notification list in confluence. Correctly there was no mail generated by the jira system.