SA-CORE-2023-002 by larowlan, james.williams, xjm, longwave, danflanagan8,...

SA-CORE-2023-002 by larowlan, james.williams, xjm, longwave, danflanagan8, jenlampton, pandaski, benjifisher

core/modules/media/src/Plugin/Field/FieldFormatter/MediaThumbnailFormatter.php

@@ -174,6 +174,14 @@ public static function isApplicable(FieldDefinitionInterface $field_definition)
     return ($field_definition->getFieldStorageDefinition()->getSetting('target_type') == 'media');
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkAccess(EntityInterface $entity) {
+    return $entity->access('view', NULL, TRUE)
+      ->andIf(parent::checkAccess($entity));
+  }
+
   /**
    * Get the URL for the media thumbnail.
    *