All that he'll know is that there's a collection which have a certain id in the database and that he cannot access it. I don't see any security risk here. If we were to generalize this technique, the application would be very hard to debug (imagine the security component throwing 404 instead of 403...) and confusing for clients.