The REST API of BPMS 6 execution server for querying task by PotentialOwner only returns results for user who was authenticated against the REST call

Issue

• It has been observed that the REST API provided by BPMS 6.0.x execution server /rest/task/query?potentialOwner=user to query tasks for potential owners doesn't work correctly. This call only returns tasks for the authenticated user id, rather than supplied user id (e.g. user in this example) in the query. Is it a bug?
• Is there any way to make it work?