Hi,

I've noticed an issue in node reference fields showing unpublished content to anonymous users. It seems that while node_reference_field_prepare_view(), for example, sets access variables, it does not get carried over to the $elements[N]['#access'] in drupal_render() (though it is in $elements['#items'][N]['access']). This makes it so that field items which should not be accessible, are.