diff --git a/core/modules/node/src/Tests/Views/BulkFormAccessTest.php b/core/modules/node/src/Tests/Views/BulkFormAccessTest.php
new file mode 100644
index 0000000..ed622fd
--- /dev/null
+++ b/core/modules/node/src/Tests/Views/BulkFormAccessTest.php
@@ -0,0 +1,145 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\node\Tests\Views\BulkFormAccessTest.
+ */
+
+namespace Drupal\node\Tests\Views;
+
+/**
+ * Tests if entity access is respected on a node bulk form.
+ *
+ * @group node
+ * @see \Drupal\node\Plugin\views\field\BulkForm
+ * @see \Drupal\node\Tests\NodeTestBase
+ * @see \Drupal\node\Tests\NodeAccessBaseTableTest
+ * @see \Drupal\node\Tests\Views\BulkFormTest
+ */
+class BulkFormAccessTest extends NodeTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array('node_test_views', 'node_access_test');
+
+  /**
+   * Views used by this test.
+   *
+   * @var array
+   */
+  public static $testViews = array('test_node_bulk_form');
+
+  /**
+   * The node access control handler.
+   *
+   * @var \Drupal\Core\Entity\EntityAccessControlHandlerInterface
+   */
+  protected $accessHandler;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    // Create Article node type.
+    $this->drupalCreateContentType(array('type' => 'article', 'name' => 'Article'));
+
+    $this->accessHandler = \Drupal::entityManager()->getAccessControlHandler('node');
+
+    node_access_test_add_field(entity_load('node_type', 'article'));
+
+    // After enabling a node access module, the access table has to be rebuild.
+    node_access_rebuild();
+
+    // Enable the private node feature of the node_access_test module.
+    \Drupal::state()->set('node_access_test.private', TRUE);
+  }
+
+  /**
+   * Tests if nodes that may not be edited, can not be edited in bulk.
+   */
+  public function testNodeEditAccess() {
+    // Create an account who will be the author of a private node.
+    $author = $this->drupalCreateUser();
+    // Create a private node (author may view, edit and delete, others may not).
+    $node = $this->drupalCreateNode(array(
+      'type' => 'article',
+      'private' => array(array(
+        'value' => TRUE,
+      )),
+      'uid' => $author->id(),
+    ));
+    // Create an account that may view the private node, but not edit it.
+    $account = $this->drupalCreateUser(array('administer nodes', 'node test view'));
+    $this->drupalLogin($account);
+
+    // Ensure the node is published.
+    $this->assertTrue($node->isPublished(), 'Node is initially published.');
+
+    // Ensure that the node can not be edited.
+    $this->assertEqual(FALSE, $this->accessHandler->access($node, 'update', $node->prepareLangcode(), $account), 'The node may not be edited.');
+
+    // Test editing the node using the bulk form.
+    $edit = array(
+      'node_bulk_form[0]' => TRUE,
+      'action' => 'node_unpublish_action',
+    );
+    $this->drupalPostForm('test-node-bulk-form', $edit, t('Apply'));
+    // Re-load the node and check the status.
+    $node = entity_load('node', $node->id(), TRUE);
+    $this->assertTrue($node->isPublished(), 'The node is still published.');
+  }
+
+  /**
+   * Tests if nodes that may not be deleted, can not be deleted in bulk.
+   */
+  public function testNodeDeleteAccess() {
+    // Create an account who will be the author of a private node.
+    $author = $this->drupalCreateUser();
+    // Create a private node (author may view, edit and delete, others may not).
+    $private_node = $this->drupalCreateNode(array(
+      'type' => 'article',
+      'private' => array(array(
+        'value' => TRUE,
+      )),
+      'uid' => $author->id(),
+    ));
+    // Create an account that may view the private node, but not delete it.
+    $account = $this->drupalCreateUser(array('access content', 'administer nodes', 'node test view'));
+    // Create a node that may be deleted too, to ensure the delete confirmation
+    // page is shown later. In node_access_test.module, nodes may only be
+    // deleted by the author.
+    $own_node = $this->drupalCreateNode(array(
+      'type' => 'article',
+      'private' => array(array(
+        'value' => TRUE,
+      )),
+      'uid' => $account->id(),
+    ));
+    $this->drupalLogin($account);
+
+    // Ensure that the private node can not be deleted.
+    $this->assertEqual(FALSE, $this->accessHandler->access($private_node, 'delete', $private_node->prepareLangcode(), $account), 'The private node may not be deleted.');
+    // Ensure that the public node may be deleted.
+    $this->assertEqual(TRUE, $this->accessHandler->access($own_node, 'delete', $own_node->prepareLangcode(), $account), 'The own node may be deleted.');
+
+    // Try to delete the node using the bulk form.
+    $edit = array(
+      'node_bulk_form[0]' => TRUE,
+      'node_bulk_form[1]' => TRUE,
+      'action' => 'node_delete_action',
+    );
+    $this->drupalPostForm('test-node-bulk-form', $edit, t('Apply'));
+    $this->drupalPostForm(NULL, array(), t('Delete'));
+    // Ensure the private node still exists.
+    $private_node = entity_load('node', $private_node->id(), TRUE);
+    $this->assertNotNull($private_node, 'The private node has not been deleted.');
+    // Ensure the own node is deleted.
+    $own_node = entity_load('node', $own_node->id(), TRUE);
+    $this->assertNull($own_node, 'The own node is deleted.');
+  }
+}
diff --git a/core/modules/user/src/Tests/Views/BulkFormAccessTest.php b/core/modules/user/src/Tests/Views/BulkFormAccessTest.php
new file mode 100644
index 0000000..16e6942
--- /dev/null
+++ b/core/modules/user/src/Tests/Views/BulkFormAccessTest.php
@@ -0,0 +1,98 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\user\Tests\Views\BulkFormAccessTest.
+ */
+
+namespace Drupal\user\Tests\Views;
+
+/**
+ * Tests if entity access is respected on an user bulk form.
+ *
+ * @group user
+ * @see \Drupal\user\Plugin\views\field\UserBulkForm
+ * @see \Drupal\user\Tests\Views\BulkFormTest
+ */
+class BulkFormAccessTest extends UserTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array('user_access_test');
+
+  /**
+   * Views used by this test.
+   *
+   * @var array
+   */
+  public static $testViews = array('test_user_bulk_form');
+
+  /**
+   * Tests if users that may not be edited, can not be edited in bulk.
+   */
+  public function testUserEditAccess() {
+    // Create an authenticated user.
+    $account = $this->drupalCreateUser(array(), 'no_edit');
+    // Ensure this account is not blocked.
+    $this->assertFalse($account->isBlocked(), 'The user is not blocked.');
+
+    // Login as user admin.
+    $this->drupalLogin($this->drupalCreateUser(array('administer users')));
+
+    // Ensure that the account "no_edit" can not be edited.
+    $this->drupalGet('user/' . $account->id() . '/edit');
+    $this->assertResponse(403, 'The user may not be edited.');
+
+    // Test blocking the account "no_edit".
+    $edit = array(
+      'user_bulk_form[' . ($account->id() -1) . ']' => TRUE,
+      'action' => 'user_block_user_action',
+    );
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+
+    // Re-load the account "no_edit" and ensure it is still not blocked.
+    $account = entity_load('user', $account->id(), TRUE);
+    $this->assertFalse($account->isBlocked(), 'The user is not blocked.');
+  }
+
+  /**
+   * Tests if users that may not be deleted, can not be deleted in bulk.
+   */
+  public function testUserDeleteAccess() {
+    // Create two authenticated users.
+    $account = $this->drupalCreateUser(array(), 'no_delete');
+    $account2 = $this->drupalCreateUser(array(), 'may_delete');
+
+    // Login as user admin.
+    $this->drupalLogin($this->drupalCreateUser(array('administer users')));
+
+    // Ensure that the account "no_delete" can not be deleted.
+    $this->drupalGet('user/' . $account->id() . '/cancel');
+    $this->assertResponse(403, 'The user "no_delete" may not be deleted.');
+    // Ensure that the account "may_delete" *can* be deleted.
+    $this->drupalGet('user/' . $account2->id() . '/cancel');
+    $this->assertResponse(200, 'The user "may_delete" may be deleted.');
+
+    // Test deleting the accounts "no_delete" and "may_delete".
+    $edit = array(
+      'user_bulk_form[' . ($account->id() -1) . ']' => TRUE,
+      'user_bulk_form[' . ($account2->id() -1) . ']' => TRUE,
+      'action' => 'user_cancel_user_action',
+    );
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+    $edit = array(
+      'user_cancel_method' => 'user_cancel_delete',
+    );
+    $this->drupalPostForm(NULL, $edit, t('Cancel accounts'));
+
+    // Ensure the account "no_delete" still exists.
+    $account = entity_load('user', $account->id(), TRUE);
+    $this->assertNotNull($account, 'The user "no_delete" is not deleted.');
+    // Ensure the account "may_delete" no longer exists.
+    $account = entity_load('user', $account2->id(), TRUE);
+    $this->assertNull($account, 'The user "may_delete" is deleted.');
+  }
+}
diff --git a/core/modules/user/tests/modules/user_access_test/user_access_test.info.yml b/core/modules/user/tests/modules/user_access_test/user_access_test.info.yml
new file mode 100644
index 0000000..5b13963
--- /dev/null
+++ b/core/modules/user/tests/modules/user_access_test/user_access_test.info.yml
@@ -0,0 +1,6 @@
+name: 'User access tests'
+type: module
+description: 'Support module for user access testing.'
+package: Testing
+version: VERSION
+core: 8.x
diff --git a/core/modules/user/tests/modules/user_access_test/user_access_test.module b/core/modules/user/tests/modules/user_access_test/user_access_test.module
new file mode 100644
index 0000000..470a76a
--- /dev/null
+++ b/core/modules/user/tests/modules/user_access_test/user_access_test.module
@@ -0,0 +1,24 @@
+<?php
+
+/**
+ * @file
+ * Dummy module implementing hook_user_access() to test if entity access is respected.
+ */
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\user\Entity\User;
+
+/**
+ * Implements hook_ENTITY_TYPE_access() for entity type "user".
+ */
+function user_access_test_user_access(User $entity, $operation, $account) {
+  if ($entity->getUsername() == "no_edit" && $operation == "update") {
+    // Deny edit access.
+    return AccessResult::forbidden();
+  }
+  if ($entity->getUsername() == "no_delete" && $operation == "delete") {
+    // Deny delete access.
+    return AccessResult::forbidden();
+  }
+  return AccessResult::neutral();
+}