An access control bypass exists in the REST API of the Frappe framework. When a document references another document via a Link field, the system fails to consistently enforce the permissions of the linked DocType during record retrieval. This allows a low-privileged authenticated user to read data and obtain fields from linked records that are outside their authorized scope.