Reproduce:

• Obtain the url displaying the entity you are not authorized to access.
• Go to this url

Expected:

• There is no information about the entity leaked

Observed:

• The breadcrumb in the header contains the name of the entity

This is based on the GET /api/entities/names endpoint