We have a private group with several private projects.
When we use the top bar menu More > Milestones the URL is this:
When you click in the “XX issues” link in a Milestone, the URL is:
If a public project happens to have a milestone with the same name, its issues appear along with our issues.
If we use the Groups > Name-of-the-group > Milestones URL, the link is different:
In this case, the “XX issues” link works, as it points to:
It seems like a bug.