Issue #3386313: The entity link label formatter does not check URL access.

core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php

@@ -2,6 +2,7 @@
 
 namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
 
+use Drupal\Core\Cache\CacheableMetadata;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\Exception\UndefinedLinkTemplateException;
 use Drupal\Core\Field\FieldItemListInterface;
@@ -66,6 +67,8 @@ public function viewElements(FieldItemListInterface $items, $langcode) {
       if ($output_as_link && !$entity->isNew()) {
         try {
           $uri = $entity->toUrl();
+          $uri_access = $uri->access(NULL, TRUE);
+          $output_as_link = $uri_access->isAllowed();
         }
         catch (UndefinedLinkTemplateException $e) {
           // This exception is thrown by \Drupal\Core\Entity\Entity::urlInfo()
@@ -95,8 +98,13 @@ public function viewElements(FieldItemListInterface $items, $langcode) {
       else {
         $elements[$delta] = ['#plain_text' => $label];
       }
+      $cacheability = new CacheableMetadata();
+      $cacheability->addCacheTags($entity->getCacheTags());
+      if (isset($uri_access)) {
+        $cacheability->addCacheableDependency($uri_access);
+      }
       $elements[$delta]['#entity'] = $entity;
-      $elements[$delta]['#cache']['tags'] = $entity->getCacheTags();
+      $cacheability->applyTo($elements[$delta]);
     }
 
     return $elements;