Cur_frm displays information, which should be not readable caused by role setting

Hi Community,

I have developed a custom app. In a doctype I have fields, with permission level of 1, to hide these fields to some users.
This works fine in view. If I do cur_frm in Javascrip console, I get this information, which should not be permitted. Is this an error or what can I do to fix this?

Thanks for your help.

PM