We're using a Drupal module (CiviNorth) which hooks into Drupal's cron execution and updates civicrm's records' custom fields.
This has been failing due to the API calls not returning those custom fields.
Enabling the "CiviCRM: access all custom data" for anonymous users appears to make it work, but I'm hesitant to turn it on since I don't know if there's any security implications.
Note: We are not using ACLs in civi though we used to. All have been disabled for a while.
Why would the API return a result for an anonymous user but refuse to show custom fields specifically?
There may be more than one things going on here. I can't tell if this is a bug relating to ACLs or just general confusion with the code.
Can anyone recreate? Any Drupal cron job that fetches custom fields would do.