SA-CORE-2025-002 by jeff cardwell, benjifisher, poker10, mingsong

core/lib/Drupal/Core/Field/FieldUpdateActionBase.php

@@ -53,7 +53,7 @@ public function access($object, ?AccountInterface $account = NULL, $return_as_ob
     $result = $object->access('update', $account, TRUE);
 
     foreach ($this->getFieldsToUpdate() as $field => $value) {
-      $result->andIf($object->{$field}->access('edit', $account, TRUE));
+      $result = $result->andIf($object->{$field}->access('edit', $account, TRUE));
     }
 
     return $return_as_object ? $result : $result->isAllowed();

core/modules/views/tests/src/FunctionalJavascript/ExposedFilterAJAXTest.php

@@ -78,6 +78,14 @@ protected function setUp(): void {
    * Tests if exposed filtering via AJAX works for the "Content" View.
    */
   public function testExposedFiltering(): void {
+    // Create an account that can update the sticky flag.
+    $user = $this->drupalCreateUser([
+      'access content overview',
+      'administer nodes',
+      'edit any page content',
+    ]);
+    $this->drupalLogin($user);
+
     // Visit the View page.
     $this->drupalGet('admin/content');