Vt*: Dashboard widgets do not follow permissions

Dashboard widgets such as lead by status etc. do not follow the permissions. They have direct database queries. As such even the records that are not accessible to the logged in users get counted in the widgets.

For example, set the sharing rule as private for Leads. Create 3 users, one with role CEO and other 2 as Sales Manager under CEO. If you would login as user with role as Sales Manager, would observe the data being generated in Lead by source widget counts on overall leads rather than just the records accessible to the logged in in Sales Manager user.