Unable to filter entities with IS NULL condition (403 Forbidden)

Problem/Motivation

Working with the JSON API, is great but the filter 'IS NULL' returns a 403 Forbidden message.

These requests work just fine and I see the results:

/jsonapi/node/event?filter[my-filter][condition][path]=field_crm_id&filter[my-filter][condition][operator]=%3D&filter[my-filter][condition][value]=test
/jsonapi/node/event?filter[elabel][condition][path]=title&filter[elabel][condition][operator]=STARTS_WITH&filter[elabel][condition][value]=Floh&page[limit]=3
/jsonapi/node/event?&page[limit]=3
/jsonapi/node/event?filter[elabel][condition][path]=field_contact_first_name&filter[elabel][condition][operator]=STARTS_WITH&filter[elabel][condition][value]=Mon&page[limit]=3
/jsonapi/node/event?filter[elabel][condition][path]=field_contact_first_name&filter[elabel][condition][operator]=NOT%20IN&filter[elabel][condition][value][1]=Chris&filter[elabel][condition][value][2]=Tom&page[limit]=3

This doesn't work:
/jsonapi/node/event?filter[elabel][condition][path]=field_crm_id&filter[elabel][condition][operator]=IS%20NULL&page[limit]=3

I thought it might be, because of the %20 - but NOT%20IN is working as well.
Then I thought it might be, because of permissions, so I gave the API user the admin role - still, it doesn't work.
Then I tried the same field with another filter, it works as well.

With IS NULL, the response is:

403 - "\n\n\n \n \n \n 403 Forbidden\n \n\n\n\n \n Server Error\n 403\n Forbidden\n
You do not have permission to access this document.

I've seen this:
https://www.drupal.org/project/drupal/issues/3194991 → but made my API admin - so maybe it's not it.
and this: https://www.drupal.org/project/drupal/issues/2986169 → but it seems like, that's only for related records.

Steps to reproduce

Beside the common modules (token, path_auto, etc.) I've got Field Permissions installed, which might be related.

• Create a entity
• Add some text fields
• Configure field permission to hide a field from users (not sure whether that matters or not)
• Fire the API request

Release notes snippet

D10.1
Field Permission: 8.x-1.2