Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. In order to solve that install the latest Drupal 9 versions.
Recent Drupal core security update for information disclosure was released this week. To solve this issue you need to use the updated version of Drupal 7, 8 and 9.
The Drupal security team announced on February 16th, 2022, the moderately critical information disclosure vulnerability in Drupal Core, SA-CORE-2022-004.