XWiki Core

$xwiki.hasAccessLevel(level, user, "Page") will check access against XWiki.Page which is obviously inappropriate. In default distribution, this happen on the Dashboard, when listing document with $xwiki.getSpaceDocsName($doc.space), which returns a list of document name without space, and these names are checked for view rights in #displayDocumentList(). This always return true, since all documents in XWiki space has view rights for anyone, and all documents are checked in this space, in place of their own space. The cause is in Util#getName(String,Context), which resolve unspecified spaces using XWiki as a constant.