As per
✨
Remove special logic for user 1 in SwitchAccessCheck
RTBC
we should remove access checks for user 1. This issue is about the check in masquerade_masquerade_access that allows user 1 to masquerade as anyone. Note that this does not cover the "masquerade as super user" case, which is still tied to user 1.
Remove these lines from masquerade_masquerade_access:
// Uid 1 may masquerade as anyone.
if ($user->id() == 1) {
return TRUE;
}
If the user is an admin user then $user->hasPermission('masquerade as any user') will return true.
