diff --git a/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php b/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php
index 6ecfa75..7901925 100644
--- a/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php
+++ b/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php
@@ -239,4 +239,13 @@ class EntityForm extends WidgetBase {
     $this->configuration['form_mode'] = $this->configuration['form_mode']['form_select'];
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public function access() {
+    return $this->entityTypeManager
+      ->getAccessControlHandler($this->configuration['entity_type'])
+      ->createAccess($this->configuration['bundle'], NULL, [], TRUE);
+  }
+
 }
diff --git a/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php b/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php
index aef8ebb..7591391 100644
--- a/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php
+++ b/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php
@@ -75,6 +75,7 @@ class EntityFormWidgetTest extends JavascriptTestBase {
     $account = $this->drupalCreateUser([
       'access entity_browser_test_entity_form entity browser pages',
       'create foo content',
+      'create article content',
       'access content',
     ]);
     $this->drupalLogin($account);
@@ -148,6 +149,16 @@ class EntityFormWidgetTest extends JavascriptTestBase {
     $parent_node = current($parent_node);
     $this->assertEquals(1, $parent_node->get('field_reference')->count(), 'There is one child node.');
     $this->assertEquals('War is peace', $parent_node->field_reference->entity->label(), 'Child node has correct title.');
+
+    // Make sure entity create access is respected.
+    $account = $this->drupalCreateUser([
+      'access entity_browser_test_entity_form entity browser pages',
+      'create foo content',
+      'access content',
+    ]);
+    $this->drupalLogin($account);
+    $this->drupalGet('entity-browser/iframe/entity_browser_test_entity_form');
+    $this->assertSession()->pageTextContains('No widgets are available.');
   }
 
 }
diff --git a/src/Entity/EntityBrowser.php b/src/Entity/EntityBrowser.php
index c969c5e..099c52b 100644
--- a/src/Entity/EntityBrowser.php
+++ b/src/Entity/EntityBrowser.php
@@ -306,6 +306,11 @@ class EntityBrowser extends ConfigEntityBase implements EntityBrowserInterface,
     $instance_ids = array_filter($instance_ids, function ($id) {
       return $this->getWidget($id)->access()->isAllowed();
     });
+
+    if (empty($instance_ids)) {
+      return NULL;
+    }
+
     return reset($instance_ids);
   }
 
diff --git a/src/EntityBrowserInterface.php b/src/EntityBrowserInterface.php
index cfad325..09a5e86 100644
--- a/src/EntityBrowserInterface.php
+++ b/src/EntityBrowserInterface.php
@@ -123,8 +123,8 @@ interface EntityBrowserInterface extends ConfigEntityInterface {
   /**
    * Gets first widget based on weights.
    *
-   * @return string
-   *   First widget instance ID.
+   * @return string|null
+   *   First widget instance ID or NULL if no widgets are available.
    */
   public function getFirstWidget();
 
diff --git a/src/Form/EntityBrowserForm.php b/src/Form/EntityBrowserForm.php
index 8383862..bcecac1 100644
--- a/src/Form/EntityBrowserForm.php
+++ b/src/Form/EntityBrowserForm.php
@@ -143,19 +143,25 @@ class EntityBrowserForm extends FormBase implements EntityBrowserFormInterface {
       'widget' => 'widget',
       'selection_display' => 'selection_display',
     ];
+
+    if (!($current_widget_id = $this->getCurrentWidget($form_state))) {
+      drupal_set_message($this->t('No widgets are available.'), 'warning');
+      return $form;
+    }
+
     $this->entityBrowser
       ->getWidgetSelector()
-      ->setDefaultWidget($this->getCurrentWidget($form_state));
+      ->setDefaultWidget($current_widget_id);
     $form[$form['#browser_parts']['widget_selector']] = $this->entityBrowser
       ->getWidgetSelector()
       ->getForm($form, $form_state);
 
-    $widget = $this->entityBrowser->getWidget($this->getCurrentWidget($form_state));
+    $widget = $this->entityBrowser->getWidget($current_widget_id);
     if ($widget->access()->isAllowed()) {
       $form[$form['#browser_parts']['widget']] = $widget->getForm($form, $form_state, $this->entityBrowser->getAdditionalWidgetParameters());
     }
     else {
-      $form[$form['#browser_parts']['widget']]['#markup'] = $this->t('Access to the widget forbidden.');
+      drupal_set_message($this->t('Access to the widget forbidden.'), 'warning');
     }
 
     // Add cache access cache metadata from the widgets to the form directly as