Edit form is displayed to user with no create/edit permission

[arladmin]

Checklist

• I'm using the latest version of Directus
• There's no other issue that already describes the problem.
• I've completed all Troubleshooting Steps.

Describe the Bug

Collections: A & B (having M2M relationship).

User has permission to Create, View & Edit (own items only) for collection A.
User has permission to Create & View junction collection of A & B.
User has permission to View for collection B (for selected fields).

In the Form view for A, in the M2M field, user selects a value from B and click on Save (in the select view).
After that, if the user now clicks on the selected record, the entire, editable record for B pops up! User can also perform editing on any of the fields in B, even the fields that are not allowed to the user. Clicking on the Save icon brings the user back to the form for A. But, clicking again on Save gives an error:

{
  "message": "You don't have permission to access this.",
  "extensions": {
    "code": "FORBIDDEN"
  }
}

So, at least the user isn't able to actually save modifications to the item in B.

My issue here is that the user shouldn't have been able to see modifiable, edit form for B, in the first place!

I tried navigating to the Edit form for the item in B via the direct link, and there the form is not editable for the user, as expected.
But the popup form for B, from A, is editable.

To Reproduce

.

Hosting Strategy

Self-Hosted (Docker Image)

[arladmin]

@Nitwel
Hi.

Is there any immediate workaround for this issue, until a permanent solution gets deployed?

This seems to be a major bug (permissions not being respected) which is blocking deployment of the project to production.

[Nitwel]

I can't think of an immediate workaround and this should also not be blocking any deployment as this is only app side and the api validates the requests properly, meaning it's only visual.

[arladmin]

@Nitwel
We are using the Directus Studio as our Frontend itself, where all the users work.
Hence, this issue's impact has exacerbated so much.