Fixes: U4-5891

src/Umbraco.Web/Trees/LegacyTreeController.cs

@@ -19,7 +19,7 @@ namespace Umbraco.Web.Trees
     /// This is used to output JSON from legacy trees
     /// </summary>
     [PluginController("UmbracoTrees")]
-    //public class LegacyTreeController : UmbracoAuthorizedApiController
+    [LegacyTreeAuthorizeAttribute]
     public class LegacyTreeController : TreeControllerBase
     {
         private readonly XmlTreeNode _xmlTreeNode;

src/Umbraco.Web/Umbraco.Web.csproj

@@ -552,6 +552,7 @@
     <Compile Include="WebApi\Filters\ClearAngularAntiForgeryTokenAttribute.cs" />
     <Compile Include="WebApi\Filters\DisableBrowserCacheAttribute.cs" />
     <Compile Include="WebApi\Filters\FilterGrouping.cs" />
+    <Compile Include="WebApi\Filters\LegacyTreeAuthorizeAttribute.cs" />
     <Compile Include="WebApi\Filters\OutgoingNoHyphenGuidFormatAttribute.cs" />
     <Compile Include="WebApi\Filters\SetAngularAntiForgeryTokensAttribute.cs" />
     <Compile Include="WebApi\Filters\UmbracoBackOfficeLogoutAttribute.cs" />
@@ -2158,4 +2159,4 @@
     <!--<PostBuildEvent>xcopy "$(ProjectDir)..\..\lib\*.dll" "$(TargetDir)*.dll" /Y</PostBuildEvent>-->
   </PropertyGroup>
   <Import Project="$(SolutionDir)\.nuget\nuget.targets" />
-</Project>
+</Project>

src/Umbraco.Web/WebApi/Filters/LegacyTreeAuthorizeAttribute.cs

@@ -0,0 +1,28 @@
+using System.Web.Http;
+using System.Web.Http.Controllers;
+using Umbraco.Core;
+
+namespace Umbraco.Web.WebApi.Filters
+{
+    internal class LegacyTreeAuthorizeAttribute : AuthorizeAttribute
+    {
+        protected override bool IsAuthorized(HttpActionContext actionContext)
+        {
+            var httpContext = actionContext.Request.TryGetHttpContext();
+            if (httpContext)
+            {
+                var treeRequest = httpContext.Result.Request.QueryString["treeType"];
+                if (treeRequest.IsNullOrWhiteSpace()) return false;
+
+                var tree = ApplicationContext.Current.Services.ApplicationTreeService.GetByAlias(treeRequest);
+                if (tree == null) return false;
+
+                return UmbracoContext.Current.Security.CurrentUser != null
+                       && UmbracoContext.Current.Security.UserHasAppAccess(tree.ApplicationAlias, UmbracoContext.Current.Security.CurrentUser);
+            }
+            return false;
+
+            
+        }
+    }
+}