SA-CORE-2021-010 by bradjones1, xjm, bbrala, gabesullice, Wim Leers, e0ipso

core/modules/jsonapi/src/ResourceType/ResourceType.php

@@ -393,7 +393,7 @@ public function getRelatableResourceTypes() {
       $this->relatableResourceTypesByField = array_reduce(array_map(function (ResourceTypeRelationship $field) {
         return [$field->getPublicName() => $field->getRelatableResourceTypes()];
       }, array_filter($this->fields, function (ResourceTypeField $field) {
-        return $field instanceof ResourceTypeRelationship;
+        return $field instanceof ResourceTypeRelationship && $field->isFieldEnabled();
       })), 'array_merge', []);
     }
     return $this->relatableResourceTypesByField;
@@ -411,7 +411,7 @@ public function getRelatableResourceTypes() {
    * @see self::getRelatableResourceTypes()
    */
   public function getRelatableResourceTypesByField($field_name) {
-    return ($field = $this->getFieldByPublicName($field_name)) && $field instanceof ResourceTypeRelationship
+    return ($field = $this->getFieldByPublicName($field_name)) && $field instanceof ResourceTypeRelationship && $field->isFieldEnabled()
       ? $field->getRelatableResourceTypes()
       : [];
   }