I have a FBA site based on default SQL membership provider.
I have 2 groups: Group1 and Group2.
I have 2 users: User1 (in Group1) and User2 (in Group2).
I have 2 custom lists: List1 and List2.
I have setup the approriate security so that User1
belonging to Group1 should not have any access to List2.
But still he can access all the items in List2
and vice-versa.

I disabled Anonymous logon, but no luck.

This was original WSS site then upgraded to MOSS 2007.

Any clue?