Hello there!
This is a bit of a weird one. End users should be able to see all their tickets regardless of the state.
If User X is the end user or cc user of ticket #12345, they should be able to see this ticket when accessing the web console—provided that they are logged on with a user account linked to the correct email address. A user can hold multiple user accounts with the same name and different email addresses, but the email address used to create the ticket will determine which tickets they can see.