If you use something like
hook_node_grants
to restrict node access all the nodes referenced in the message entity will respect the permissions and show you blanks instead of the field you want.
Related to this I guess
#1804586: "Fetch entity by property" + node access = not working properly when launched by cron →
My solution has been to do
global $user;
$user = user_load(1);
on hook_cron an then restore it again to anonymous
Closed: outdated
1.0
Code