Scheduled reports include stats from sites a user doesn't have any access to in the All Websites section.
I have confirmed this happens with newly created users as well. It also only happens in the scheduled reports, sending them manually does not include the disallowed data.
This is really bad, I had to disable all email reports.
what version of Piwik are you using? please upgade to latest as this bug should be fixed.
I could verify the problem and will propose a patch before next release. thanks for the report!
(In [6957]) Fixes #3355 Can you please test to apply this patch and confirm if it fixes the issue for you?
Yes, the patch fixes the issue for me. Thanks!