#3522754: Validate URL access on menu item.

Closes #3522754

core/modules/system/src/Access/SystemAdminMenuBlockAccessCheck.php

@@ -103,6 +103,20 @@ protected function hasAccessToChildMenuItems(MenuLinkInterface $link, AccountInt
     }
 
     foreach ($this->menuLinkTree->load(NULL, $parameters) as $element) {
+      // Check if the menu item isn't a route.
+      if ($element->link->getRouteName() === '') {
+        $url = $element->link->getUrlObject();
+        // If the menu item is a URL but not a route, continue.
+        if (!$url->isRouted()) {
+          continue;
+        }
+
+        // Check access to the URL.
+        if ($url->access($account)) {
+          return AccessResult::allowed();
+        }
+      }
+
       if (!$this->accessManager->checkNamedRoute($element->link->getRouteName(), $element->link->getRouteParameters(), $account)) {
         continue;
       }