I solved this issue very quickly so not sure how widespread it was but had at least 1 admin user that had access to all cameras including groups they shouldn't have access to. Problem was solved by updating the version so I'm guessing the bug was fixed but thought I should make a post about it because I couldn't find any mentions of it and its a bit of a security concern.
Issue was on version 5.9.9.12 and was fixed by updating to 5.9.9.14. I was also experiencing issues with viewing individual cameras in the web portal and that has also been resolved by updating.
If you are still on 5.9.9.12 or older I would recommend updating as soon and you can.