TYPO3 Core

File : /typo3/sysext/backend/Classes/Search/LiveSearch/LiveSearch.php (v6.2.3)
File : /t3lib/search/class.t3lib_search_livesearch.php (v4.5.39)

function : findByGlobalTableList
it search in all available fields in all tables from TCA.
In deeper function, there is a filter on page ID, but nothing on "access right" for specific table (like exclude "sys_template" for non admin).

the loop in "findByGlobalTableList" may verify access right for table before trying to make query for this table.

I'm not sure but we can use something like :
$GLOBALS['BE_USER']->check('tables_select', $tableName)

    protected function findByGlobalTableList($pageIdList) {
        $limit = $this->limitCount;
        $getRecordArray = array();
        foreach ($GLOBALS['TCA'] as $tableName => $value) {

/********** from here ********/
            //if no "listing access" for the table, skip this table (maybe must check "tables_modify", I don't know)
            if (!$GLOBALS['BE_USER']->check('tables_select', $tableName)){
                continue;
            }
/********** to here ********/
            $recordArray = $this->findByTable($tableName, $pageIdList, '0,' . $limit);
            $recordCount = count($recordArray);
            if ($recordCount) {
                $limit = $limit - $recordCount;
                $getRecordArray[] = $recordArray;
                if ($limit <= 0) {
                    break;
                }
            }
        }
        return $getRecordArray;
    }

The "bug" was observed on the version 6.2.9

Olivier SC wrote:

[...]
I can provide patch, but for witch version of TYPO3?

Hi Olivier, if you create a patch this should normally always be for master.

Gr. Frans