AJAX previews ignore permissions
It is possible for a user to see text from a part of the wiki they can't nornally view because of forum permissions, if a link (likely an autolink) to a hidden article is posted publicly and they hover for an AJAX preview. Clicking the link will return a permission error, but the preview will show a paragraph from the target page.
Fixed for the next build.