TYPO3 Core

Since user authentication is performed before page id is resolved,
there is no way to set a pid list for only a part of the page tree (chicken/egg problem).
In which page tree we end up, we only know after authentication.

Therefore different pid for fe user storage is only useful for organizational purposes. It is not possible to use this for authorization.
Authorization can solely be controlled with user groups.

This means in a multi site setup and a requirement that fe users from one site don't have access to other sites,
the fact that a user successfully logged in, must not be used to restrict access. Instead access restriction must be done with user groups.

What could be possible though (but isn't implemented) is to enforce pid for fe users per domain.

I already expected this answer ("use user groups") ;)
But this doesn't solve the problem that a user still can login where he shouldn't (login is successful, but he can't access any restricted page unless he is in the right user group).

Isn't this bug identical to the now fixed security issue https://typo3.org/security/advisory/typo3-core-sa-2022-013 ? @Oliver Hader

@Torben Hansen Thanks for fixing this.