I have a page that I've set for the site home page. The controller is querying a custom object (Interest Selections) to display a list of check boxes.

I've set the object access to read-only for the web site user profile (and even tested with full access writes). But the page fails to load when reading from this object.

VF Page:

<apex:page Controller="tempELeadImportController" id="ELeadImportPage" showheader="false" sidebar="false" >
 <apex:pageBlock title="Import Detail"  > 
  <apex:OutputText value="{!NewProspectStatus}" /> 
 </apex:pageBlock> 
 <apex:form id="ELeadImportForm" > 
   <!-- other items here that work --> 
   <apex:pageBlockSection showHeader="true" title="I'm interested in" columns="1" collapsible="false">
 
     <apex:selectCheckboxes id="Components" title="Components" value="{!SelectedComponents}" > 
     <apex:selectOptions value="{!ComponentSelections}"/> 
     </apex:selectCheckboxes> 

   </apex:pageBlockSection> 
  </apex:pageBlock> 
 </apex:form> 
</apex:page>

Apex controller where "ComponentSelections are being created:

global List<SelectOption> ComponentSelections
{
 get
 {
  set<string> componentNames = new set<string>();
    
    // Query the interest selection table to find all the components that are in there. - Note if there are more than 10k records this will break.
    AggregateResult[] validComponents = [SELECT i360__Component__c 
                                        FROM i360__Interest_Selection__c 
                                        WHERE i360__Component__c != null GROUP BY i360__Component__c];
    system.Debug(validComponents);
    for(AggregateResult ar : validComponents)
    {
        string component = (string) ar.get('i360__Component__c');
        componentNames.add(component);
    }
    List<SelectOption> Components = new List<SelectOption>();
    for (string src : componentNames)
    {
        SelectOption option = new SelectOption(src, src);
        Components.Add(option);
    }
    system.Debug(Components);
    return Components;       
  }
}

 Even when the web site user profile has FULL access to the "Interest Selections" object, the user cannot read those values. If I change the controller to "without sharing" [WHICH I KNOW IS NOT THE CORRECT FIX] then everything works. Therefore, there is something else stopping the access to these values.