Hello.
I'm confused why untranslated content accessible for anonymous by /{lang}/node/nid
- install drupal instanse
- enable translations
- add more than 2 languages (en, es, af)
- create node
- translate this node from 1 to 2 language (en to es)
- open site as anonymous and try to access to untranslated content on 3 language as /af/node/nid
- you will see content on 3 language (af) by this link
Anonymous users without roles for it shouldn't view content on language, that really not present on this language.
Only admin role that has permission "Bypass content access control" should have this possibility.
Postponed: needs info
11.0 🔥
I think this module solves it: https://www.drupal.org/project/content_language_access →
This doesn't meet the definition of critical → AFAICT. The displayed content is published, it's just showing English as a fallback when the current language isn't available.
I am pretty sure this works as designed, but leaving open in case anyone has further info.