Issue Summary

This is reproducible on Data Center: (yes)

When an Assets object has multiple outbound reference, there is an option: Show All available to see all referenced objects in a pop up screen.

If the outbound references include some object types the user does not have permission to see - clicking Show All to show all outbound references from the Object page will result in a blank screen.

Doing the same from the Schema view (List or Detail view) - will open the expected screen, with only accessible objects visible.

Steps to Reproduce

1. As an Assets Admin / Schema Manager: Create 3 object types (inheritance is optional, but not required):
   OTA
      |—OTB
      |—OTC
2. Set an outbound reference from OTA to itself ("Object" type of attribute to set a reference to OTA). In the Attribute configuration, check the option: Include Children
3. Create 7 OTB objects and 7 OTC objects
4. Create one OTA object to reference ALL OTB and OTC objects (14)
5. Set your own user to ALL the 3 roles of OTC so that you are the only user that can see OTC objects
6. Login as another User with visibility to the Schema
7. Navigate to OTA and see the object created there, showing correctly 7 outbound references. Click "Show All" and see the pop up screen showing these 7 objects (OTB)
8. Navigate to the OTA object page (by clicking its Key or Label) See that the Outbound attribute is showing a total of 7 objects with an option to Show all (if the option is missing - add more OTB objects and reference them)
9. Click "Show All"

Expected Results

A pop up screen with all the referenced objects the User is allowed to view in it.

Actual Results

A blank Jira screen with no content, only top menu and Jira footer.

Workaround

Do not use the Object page to view all outbound references - use the Schema view to do so.

Another option; edit the Object Type Layout:
In the Details Tab - remove the outbound referencing attribute - so that it will not be visible.

Add a Tab to the object view, to use the AQL widget with an AQL such as:

objectType IN objectTypeAndChildren(OTA) AND object HAVING inR(Key=${Key})

This will allow you to view ALL the visible outbound references from the said attribute, while respecting permissions on the Object View.