The fetch function reverse_related_objects doesn't respect the read permissions, it returns also objects ,for which the current user doesn't have read permissions to.

It should respect rad permissions, and the parameter "limitations" should be added just like in list fetch function.