**Overview** The `delete content translations` permission (provided by the `content_translation` module) is intended to control whether a user can delete translations for content entities. However, the Canvas API route responsible for deleting content (canvas_page) translations does not currently require this permission. The route `canvas.api.content.translation.delete `(`/canvas/api/v0/content/canvas_page/{canvas_page}/translations`) only checks `_entity_access: 'canvas_page.update'`. A user who has the canvas_page update permission but not the delete content translations permission can currently delete translations through the Canvas UI, bypassing the intended access control. There is already a @todo in `canvas.routing.yml` that explicitly acknowledges this gap: ``` # @todo Consider supporting the `delete content translations` permission provided by the content_translation module. # @see \content_translation_translate_access() ``` **Proposed Solution** Add `_permission: 'delete content translations'` as an additional requirement on the canvas.api.content.translation.delete route in `canvas.routing.yml`.