diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Menu/MenuResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/Menu/MenuResourceTestBase.php
index dd7f552..6e5dcc5 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Menu/MenuResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Menu/MenuResourceTestBase.php
@@ -26,7 +26,17 @@
    * {@inheritdoc}
    */
   protected function setUpAuthorization($method) {
-    $this->grantPermissionsToTestedRole(['administer menu']);
+    switch ($method) {
+      case 'GET':
+        $this->grantPermissionsToTestedRole(['access content']);
+        break;
+
+      case 'POST':
+      case 'PATCH':
+      case 'DELETE':
+        $this->grantPermissionsToTestedRole(['administer menu']);
+        break;
+    }
   }
 
   /**
@@ -75,4 +85,21 @@ protected function getExpectedCacheContexts() {
     ];
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  protected function getExpectedUnauthorizedAccessMessage($method) {
+    if ($this->config('rest.settings')->get('bc_entity_resource_permissions')) {
+      return parent::getExpectedUnauthorizedAccessMessage($method);
+    }
+
+    switch ($method) {
+      case 'GET':
+        return "The 'access content' permission is required.";
+
+      default:
+        return parent::getExpectedUnauthorizedAccessMessage($method);
+    }
+  }
+
 }
diff --git a/core/modules/system/src/MenuAccessControlHandler.php b/core/modules/system/src/MenuAccessControlHandler.php
index 034f45a..e2c7bcd 100644
--- a/core/modules/system/src/MenuAccessControlHandler.php
+++ b/core/modules/system/src/MenuAccessControlHandler.php
@@ -19,7 +19,7 @@ class MenuAccessControlHandler extends EntityAccessControlHandler {
    */
   protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
     if ($operation === 'view') {
-      return AccessResult::allowed();
+      return AccessResult::allowedIfHasPermission($account, 'access content');
     }
     // Locked menus could not be deleted.
     elseif ($operation == 'delete') {