The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
http://www.securitytracker.com/id/1033950
http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html