I have a Sharepoint 2016 (on premise) subsite which users are collaborating on a document with that isn't in a workflow. These users are added to the site programmatically to have contribute permission upon the site being created. However, when they try to access the document or the subsite itself, they receive an "Access Denied" error. Users are not granted permissions to the parent site, only directly to the subsite.
Upon looking at the permissions of the user on the site (Site Settings > Site permissions), the permission levels of the users appear as I would expect them to however, upon checking Check Permissions, most of the users are showing as having "None" permissions. A couple do appear to have Contribute permissions as I would expect.
The ULS log files don't show anything out of the ordinary during site creation. I see the site being created, the document being added and then the users being granted access as I might expect without any obvious errors but when they try to log in, the ULS file shows that their permission is 0x00000000 rather than 0x00010000, which I presume is Contribute permission in Sharepoint.
At this point, I am thinking it might be a database level problem but if that was the case, I would have thought that it would have caused other problems rather than this specifically. So why would Check Permissions show one permission level and the Site Permissions list show another?