When unattended controller renders a template, it finds it in a correct taxonomy in method provisioning_template, but then it is passed into the renderer outside of the taxonomy block in TemplateRendering#render_template. Therefore all snippets being loaded via SnippetRendering#snippet (source.find_snippet(name)) is called without Taxonomy handling (basically unscoped SQL query). This is possibly a security issue as well when all snippets are essentially shared across all organizations even when taxonomy is not set like that.