As additional information: We did not check it but we're sure that the same problem also occurs for the e-mail notification as this contains the history.

In the e-mail notification, also in the history only those field should be available which the user who recevices the notification is able to read.

The first issue, visibility of custom fields in the history could be fixed by adding the following in history_inc.php:

After the line:
foreach ( $t_history as $t_item ) {

add:

    $t_custom_field_id = custom_field_get_id_from_name($t_item['note']);
    if (!$t_custom_field_id == '') {
        if (custom_field_has_read_access($t_custom_field_id, $f_bug_id)) {

and before the end of the loop, add:

        }
    }

I do not know if this is the best way to fix it, but it works :-)

I think this solution isn't really good, because there's still the problem that the custom fields will be shown in the e-mail notification.

And also from my perspective, it may be a performance issue. Because fields/information are read from the database that are not really needed...

fixed in CVS
core/history_api.php -> 1.35