Can delete content and bypass trash with the parameter in_trash

I think you have a module that clashes with Trash's node's access control handler override. Can you check that, for example using this code: get_class(\Drupal::entityTypeManager()->getAccessControlHandler('node'));?

I setup a sandbox so there is no custom code involved.

get_class(\Drupal::entityTypeManager()->getAccessControlHandler('node'))
"Drupal\trash\EntityHandler\TrashNodeAccessControlHandler"

Then I need more info on the exact steps to reproduce, trash version, etc. because I tried the steps in the issue summary and I get a 403 when accessing node/X/delete?in_trash=1 or <code>node/X/delete?in_trash for a deleted node.

Another thing to check is whether 🐛 Users without permission still see action links Active changed something for you.