I created two objects ObjectVisible and ObjectHide. ObjectVisible has lookup fields to ObjectHide. I set the OWD as follows: ObjectVisible: Public Read, ObjectHide: Private
I used custom code to share ObjectHide by creating records in ObjectHide__share table. I added the ObjectVisible to standard Accounts page layout.
The issue is, users that don't have access to the ObjectHide record can see the field values through the ObjectVisible related list on the Account page.
Is this expected? or some sort of a loophole in object level security? Is there anything else I need to set to enforce the field level security of ObjectHide when it's viewed through the related list of ObjectVisible?
Example: UserA has access to an ObjectHidden record, UserB doesn't. Both users have access to ObjectVisible record that has lookup fields to ObjectHidden record. ObjectVisible related list is on the standard Account page. Both users are able to see the contents of ObjectVisible related list, including the values in the lookup fields pointing to ObjectHidden (I expected UserB not to be able to see the values). When UserA clicks on an item in the related list pointing to the HiddenObject record, it loads the details of the HiddenObject record, but when UserB clicks it, it display insufficient privileges (good thing). The problem is why is UserB able to see the HiddenObject values through the VisibleObject related list?