Fix security issues with checking group but not reference when accessing references

[pbexe]

Fix security issues with checking group but not reference when accessing references. This issue was created from todoist so it may be a bit sparse