An Apex page that utilizes the getListViewOptions() method of StandardSetController, is displaying ALL list views even though the user does not have access to the view and is not a part of any assigned Groups.
This occurs because the Manage Public List Views permission on the user's Profile overrides the group-based visibility controls built into Salesforce list view sharing.
How to Fix
To restrict the user to only the list views accessible via their assigned groups, remove the Manage Public List Views permission from their Profile:
Once this permission is unchecked, the user will only see list views that are accessible to them via their assigned groups.
000391158

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.