Service Catalog: User is able to select the value in the variable even when the user doesn't have access to the fields.DescriptionService Catalog: The user is able to select the value in the variable even when the user doesn't have access to the fields.Steps to Reproduce Steps to Reproduce1. Make sure you deactivate the ACLs on the sc_category.* read ACL ( d62058832373230018a4fa9e27bf65bc, 87348077c3210200e69810c422d3ae2a) except the ACL aec8be7487331010c84e4561d5cb0b5c2. Also deactivate the sc_category.titile ACL 889f94da5f2111001c9b2572f2b4773f These ACLs are not present on the older instances. 3. Login to the Quebec instance4. Impersonate ITIL user5. Navigate to Standard Change Catalog6. Select Template Management7. Select Propose a new Standard Change Template ( record producer) 8. In the Category Variable, click on the Search icon and see the record variables are not visible9. Now Search for any valid category "Hardware Asset"10. Even when the ITIL user does not have access to the record or the field, they are able to see the Display valueWorkaroundThe fix for this issue is just adding of the missing roles in the field level ACL for sc_category. The rest of the behavior remains the same as it counts as a configuration error when the admin is creating a reference variable referencing a table to which the user does not have a read access to the display field.Related Problem: PRB1498848