Patch in 50

Closes #3023527

src/QueryAccess/QueryAccessHandlerBase.php

@@ -147,7 +147,12 @@ abstract class QueryAccessHandlerBase implements EntityHandlerInterface, QueryAc
         $published_conditions->addCondition($entity_conditions);
         $published_conditions->addCondition($published_key, '1');
       }
-      if ($has_owner && $account->hasPermission("view own unpublished $entity_type_id")) {
+      if ($account->hasPermission("view any unpublished $entity_type_id")) {
+        $unpublished_conditions = new ConditionGroup('AND');
+        $unpublished_conditions->addCacheContexts(['user.permissions']);
+        $unpublished_conditions->addCondition($published_key, '0');
+      }
+      elseif ($has_owner && $account->hasPermission("view own unpublished $entity_type_id")) {
         $unpublished_conditions = new ConditionGroup('AND');
         $unpublished_conditions->addCacheContexts(['user']);
         $unpublished_conditions->addCondition($owner_key, $account->id());