Pinned entity creation form shows wrong data

Impact

Logged in user can access page state data of pinned pages of other users by pageId hash.

Patch

--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php
+++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php
@@ -158,6 +158,13 @@
             AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId'))
         );
 
+        if ($entity) {
+            $entity = $this->getEntity($entity->getId());
+        }
+        if (!$entity) {
+            return $this->handleNotFound();
+        }
+
         return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK));
     }