I have set OWD for both Account and Contact to Private. I created an Account and shared it with all users. I created a Contact for that Account, but I didn't share it with any users.
I log in as a different user and I have access to the Contact. The reason: "Account Sharing". How can this be?
I checked and double checked, but the OWD for both objects are Private, not Controlled by Parent.
Role hierarchy cannot be the cause: the Contact was created at the highest level and I log in as a user that is low in the hierarchy. Besides, the reason would have been role hierarchy, not Account Sharing.