TYPO3 Core

I can confirm this bug. If you clear the column reviewers in the sys_workspace table the custom stages works fine.

This bug come from a part of code that use old database field "reviewers" (from previous workspace structure before TYPO3 v4.5) of "sys_workspace" table.
/typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php
function checkWorkspace(...)

// Checking if he is reviewer user:
if (GeneralUtility::inList($wsRec['reviewers'], 'be_users_' . $this->user['uid'])) {
    return array_merge($wsRec, array('_ACCESS' => 'reviewer'));
}
// Checking if he is reviewer through a user group of his:
foreach ($this->userGroupsUID as $groupUid) {
    if (GeneralUtility::inList($wsRec['reviewers'], 'be_groups_' . $groupUid)) {
        return array_merge($wsRec, array('_ACCESS' => 'reviewer'));
    }
}

The result of "_ACCESS" is checked in function workspaceCheckStageForCurrent(...) for custom stage :

if ($workspaceRec['custom_stages'] > 0 && $stage !== 0 && $stage !== -10) {
    // Get custom stage record
    $workspaceStageRec = BackendUtility::getRecord('sys_workspace_stage', $stage);
    // Check if the user is responsible for the current stage
    if (
        $stat['_ACCESS'] === 'owner'
        || $stat['_ACCESS'] === 'member'
        && GeneralUtility::inList($workspaceStageRec['responsible_persons'], 'be_users_' . $this->user['uid'])
    ) {
        return true;
    }
    [...]
}

The text "reviewer" is also used in various places of the code (in workspace notification, in some sql query, in dataset for testing).
I think all those parts of code can be removed.

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/61643