Route access bypass due to wrong route match for <current> route

Triaged as part of BSI

Does this issue still apply? Is it only a bug when #2599958: Possible access bypass for rendered links → is applied? If so perhaps it should be moved there?

If not, please supply steps to reproduce from a fresh Drupal install.

Thanks!

Could it be related to [ 🐛 Url access / PathValidator not language/options aware Active ] where the Url object not being a "full" Url object when created with <current> leads to access checks falsely returning false?

There has been no response to the request for confirmation that this problem exists on a currently support version of Drupal. Since it has been a year and since that request and there has been no other confirmation in 8 years, I am closing this issue.

If you are experiencing this problem on a supported version of Drupal reopen the issue, by setting the status to 'Active', and provide complete steps to reproduce the issue → (starting from "Install Drupal core").

Thanks