A bit of clarification please. Access to what? All site’s front ends are public by default. Anyone can see any site, logged in or not.
The back end is a different story. A user should only be able to access the back end of a site to which they belong. If otherwise, please double check. WP will redirect users attempting to log into the wrong site over to their proper site. Since all back ends look the same, this can be deceiving. It may seem like you’ve gained access where you don’t belong, but if you double check the URL you’re at, it might be the correct site after all.
If any user can access the back ends of sites to which they do not belong, something is indeed amiss. It might be due to the current theme or plugins. For one of the sites as its admin, deactivate all plugins and switch to one of the default twenty* themes. Log out, then try logging into the same site as an user who does not belong. The attempt should now fail.
To identify the module allowing improper access, restore the normal theme, then its plugins, one at a time, until the problem recurs. To avoid a lot of logging in and out, I suggest using a completely different browser for the admin login, and something else for testing. Be aware that caching can confuse testing results. To avoid this, disable any server side caching and in the test browser keep a tab open to the browser’s clear cache screen. Clear the cache prior to every test.
