diff --git a/organize/tracking/README.txt b/organize/tracking/README.txt
index ddfecd0..3e5dca6 100644
--- a/organize/tracking/README.txt
+++ b/organize/tracking/README.txt
@@ -178,8 +178,8 @@ Recent changes
   >>> data[0].timeStamp
   u'... ...:...'
   >>> data[0].objectData
-  {'url': '', 'version': '', 'type': u'Text',
-   'object': <loops.resource.Resource ...>, 'title': 'Change Doc 001'}
+  {'version': '', 'canAccess': True, 'title': 'Change Doc 001', 'url': '',
+   'object': <loops.resource.Resource object at ...>, 'type': u'Text'}
   >>> data[0].user
   {'url': '', 'object': <loops.concept.Concept ...>, 'title': u'john'}
   >>> data[0].action
diff --git a/organize/tracking/report.pt b/organize/tracking/report.pt
index 51ab279..2708476 100644
--- a/organize/tracking/report.pt
+++ b/organize/tracking/report.pt
@@ -70,7 +70,8 @@
     <tr tal:repeat="row info/data"
         tal:attributes="class python: repeat['row'].odd() and 'even' or 'odd'">
       <tal:row define="object row/objectData;
-                       url object/url">
+                       url object/url"
+               condition="object/canAccess">
         <td tal:attributes="title object/object/description">
           <a tal:omit-tag="not:url"
              tal:attributes="href string:$url?version=this"
diff --git a/organize/tracking/report.py b/organize/tracking/report.py
index 419fb56..78aeb17 100644
--- a/organize/tracking/report.py
+++ b/organize/tracking/report.py
@@ -36,6 +36,7 @@ from cybertools.meta.interfaces import IOptions
 from cybertools.util import format
 from loops.browser.common import BaseView
 from loops.interfaces import IConcept, IResource
+from loops.security.common import canAccessObject
 from loops import util
 from loops.util import _
 from loops.versioning.interfaces import IVersionable
@@ -267,7 +268,8 @@ class TrackDetails(BaseView):
         versionable = IVersionable(self.object, None)
         version = versionable is not None and versionable.versionId or ''
         return dict(object=obj, title=obj.title,
-                    type=self.longTypeTitle, url=url, version=version)
+                    type=self.longTypeTitle, url=url, version=version,
+                    canAccess=canAccessObject(obj))
 
     @Lazy
     def user(self):