TYPO3 Core

cache_treelist table caches the tree for the current user. If the user is anonymous, fetching cached tree for logged in backend users will skip pages allowed for those users. If the backend user was logged in when cache was created, anonymous users will get a list of pages accessible to that user (basically: hidden pages are added to cache_treelist).
exspecially confusing when using \TYPO3\CMS\Frontend\DataProcessing\DatabaseQueryProcessor and use preview of hidden page.

Example TS:

tt_content {
    nestedContentElement {
        templateName = NestedContentElement 
        dataProcessing {
            10 = TYPO3\CMS\Frontend\DataProcessing\DatabaseQueryProcessor
            10 {
                table = tx_extensionname_domain_model_nestedcontent
                pidInList = 1
                languageField = sys_language_uid
                where.data = field:uid
                where.wrap = contentelement=|
                recursive = 99
                orderBy = sorting
                as = nestedContent
            }
        }
    }
}

Reproducable in TYPO3 8.7 & 9.5
related to / very much the same as #22236 issued with frontend users