.../user/src/Plugin/rest/resource/UserResource.php | 27 ++++++++++++++++++++++
 core/modules/user/user.module                      |  9 ++++++++
 2 files changed, 36 insertions(+)

diff --git a/core/modules/user/src/Plugin/rest/resource/UserResource.php b/core/modules/user/src/Plugin/rest/resource/UserResource.php
new file mode 100644
index 0000000..0df3925
--- /dev/null
+++ b/core/modules/user/src/Plugin/rest/resource/UserResource.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Drupal\user\Plugin\rest\resource;
+
+use Drupal\Core\Field\FieldItemListInterface;
+use Drupal\rest\Plugin\rest\resource\EntityResource;
+
+class UserResource extends EntityResource {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkPatchFieldAccess($field_name, FieldItemListInterface $original_field, FieldItemListInterface $received_field) {
+    // The User entity type's 'pass' field is a very special case: even though
+    // it is not allowed to be viewed nor edited, to be able to modify
+    // security-sensitive fields, the password must be specified.
+    // @see \Drupal\Tests\rest\Functional\EntityResource\User\UserResourceTestBase::testPatchDxForSecuritySensitiveBaseFields()
+    if ($field_name === 'pass') {
+      return TRUE;
+    }
+    else {
+      return parent::checkPatchFieldAccess($field_name, $original_field, $received_field);
+    }
+  }
+
+
+}
\ No newline at end of file
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 2d7d24a..474e8e2 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -1445,3 +1445,12 @@ function template_preprocess_user(&$variables) {
     $variables['content'][$key] = $variables['elements'][$key];
   }
 }
+
+/**
+ * Implements hook_rest_resource_alter().
+ */
+function user_rest_resource_alter(&$definitions) {
+  if (isset($definitions['entity:user'])) {
+    $definitions['entity:user']['class'] = \Drupal\user\Plugin\rest\resource\UserResource::class;
+  }
+}