Change record status: 
Project: 
Introduced in branch: 
3.0.x
Introduced in version: 
3.0.0
Description: 

What changed

The Drush generator template routing.yml.twig was generating collection routes with the wrong permission: administer site configuration instead of the module-specific administer subentities.

This has been fixed in the template. New code generated after this fix will use the correct permission.

Why it changed

The generated permission did not match the permission defined in subentity.permissions.yml, which means the collection route was not properly guarded by the Sub Entity access model.

What you need to do

If you generated a sub-entity type before this fix, open your module's routing.yml and update the _permission requirement on the collection route:

Before:

entity.my_entity.collection:
  path: '/admin/content/my_entity'
  defaults:
    _entity_list: 'my_entity'
    _title: 'My Entity List'
  requirements:
    _permission: 'administer site configuration'

After:

entity.my_entity.collection:
  path: '/admin/content/my_entity'
  defaults:
    _entity_list: 'my_entity'
    _title: 'My Entity List'
  requirements:
    _permission: 'administer subentities'
Impacts: 
Module developers