Improper Input Validation

ux-autocomplete is vulnerable to Improper Input Validation. The vulnerability is due to a missing validation check while submitting an entry id for an EntityType when selecting an entry in the Autocomplete UI component. This causes an entity id for an EntityType that is not part of the valid choices to be selected and even when the matching record for that entry id is not returned by the custom query built with query_builder. The affected applications are only those which either use a custom query_builder option to limit the valid results and EntityType with autocomplete => true or a custom AsEntityAutocompleteField.