Currently, users without the capability the read the source repository of a pull request will be able to see the PR in the list but they will an error if they try to access it.
The current behavior is inconsistent. A user with the capability to read only the destination repository should be able to access the PR (code associated with the PR can already be accessed via the reference store under refs/tlpr/:id/head)