Ticket #13425: 13425.patch

src/wp-includes/media.php

@@ -826 +826 @@
                 'link'       => ''
         ), $attr, 'gallery'));
 
-        $id = intval($id);
+        $id = intval( $id );
+
+        if ( $id && ! current_user_can( 'read_post', $id ) ) {
+                return '';
+        }
+
         if ( 'RAND' == $order )
                 $orderby = 'none';