cubicweb #979903 different results for a simple request between different users [resolved]

On Logilab's extranet, I have a bookmark with the following RQL request:

rql=Any T WHERE P is Project, P name "Pylos", T concerns P, T in_state S, S name "open", NOT T done_in V

When I follow the link, I get 55 tickets. When one of our customers (cabsil) does so, she get 2767 results with lots of duplicates.

Syt says "sounds like a security issue".

done in3.8.3
load left0.000
closed by<not specified>