Searchbox displays all contacts, independently of ACLs

When stopping on the searchbox in the top bar (like after pressing the down-arrow), the auto-complete feature lists all contacts, even if the user does not have a view access to all contacts. This is an important security issue in my opinion, as it discloses the complete database to non-authorized users.

I believe there is a serious issue behind this, as read-rights seem to be verified in the GUI part and not in the data-access layer. I suggest to change this in the next major release.