Issue #155039 by agoradesign, goldorak: View access rights do not work correctly, allowing easy bypass to view any commerce_return entity