Issue #1847600 by amateescu: Fixed Use proper entity 'view' access checks in entity reference.

core/modules/entity_reference/lib/Drupal/entity_reference/EntityReferenceAutocomplete.php

@@ -67,9 +67,7 @@ public function getMatches($field, $instance, $entity_type, $entity_id = '', $pr
     if ($entity_id !== 'NULL') {
       $entities = $this->entityManager->getStorageController($entity_type)->load(array($entity_id));
       $entity = reset($entities);
-      // @todo: Improve when we have entity_access().
-      $entity_access = $target_type == 'node' ? node_access('view', $entity) : TRUE;
-      if (!$entity || !$entity_access) {
+      if (!$entity || !$entity->access('view')) {
         throw new AccessDeniedHttpException();
       }
     }

core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceFormatterBase.php

@@ -75,9 +75,7 @@ public function prepareView(array $entities, $langcode, array &$items) {
           $entity = $target_entities[$identifier];
           $items[$id][$delta]['entity'] = $entity;
 
-          // @todo: Improve when we have entity_access().
-          $entity_access = $target_type == 'node' ? node_access('view', $entity) : TRUE;
-          if (!$entity_access) {
+          if (!$entity->access('view')) {
             continue;
           }
         }