TYPO3 Core

In an instance that has been updated from TYPO3 10.4.36 to 11.5.24, subpages of an access protected page with the extendToSubpages option enabled are still visible in a frontend menu. This bug occurred once in TYPO3 9.5.12 and has been resolved, see #89989.

backend pagetree example:

• Root
  • Public
  • Secure (Usergroup Access Rights: usergroup, Extend to Subpages: enabled, Page enabled in menus: disabled)
    • Mainmenu Parentpage (Usergroup Access Rights: Show at any login, Extend to Subpages: enabled, Page enabled in menus: disabled) <<< {$mainmenuPid}
      • Subpage 1 (Page enabled in menus: enabled)
      • Subpage 2 (Page enabled in menus: enabled)
        • Sub Subpage 2 (Page enabled in menus: enabled)
          ...

menu processor:

page.10.dataProcessing.30 = TYPO3\CMS\Frontend\DataProcessing\MenuProcessor
page.10.dataProcessing.30 {
    special = directory
    special.value = {$mainmenuPid}
    levels = 4
    expandAll = 1
    includeSpacer = 1
    titleField = nav_title // title
    as = mainmenu
}

To hide the subpages of "Mainmenu Parentpage", an "Usergroup Access Rights" item needs to selected. The visibility of the subpages should be taken over from the parent page by extendToSubpages.