Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure