This is not due to be fixed, so I'm posting this so other users are aware.
I believe there will be an upcoming techdoc covering it too.
- When Project modify baseline right is provided via OBS it provides edit rights, when global it does not.
How to replicate:
- Create a user
- Create a group add the global rights "project navigate" and project modify baseline
- Provide instance view rights for the user to a project
- Log in - user can only view the project
- Amend the group, instead of project modify baseline being global, set it via the OBS on the project.
- Log back in. User now can edit any project in the OBS.
Hope this helps