I have users that have restriction on content read policy, in order not to bother them with parts of the tree they do not need.
But If I put them a restriction, they are not able to insert an image in the ezxmltext attribute.

They have sufficient right to see the media section. But the insertion popup does not provide a tab to directly access to the media section. They have to go up with the arrow to see the media section. But when they arrive in the root node, they have an authorisation failure when they arrive on the root node.

After many tries, I've observed this:
If I have no restriction on the 'content read' policy, it works.
If I put a pseudo restriction, that is that they are allowed to see all the subtrees at the uppermost possible level, it does not work.

This was working fine in 3.6.x