In Lessons if user has lessonbuilder.seeall but not lessonbuilder.upd on their role and they access a page with a linked assessment that has been deleted, they'll get a stack trace.

It looks like the error is in the

if (canSeeAll) where the entity is not rechecked for null. in any of these cases here.