Confirmed by a user in german forum: https://forum.joomla.de/thread/6617-bug-o-feature-rechteproblem-mit-benutzerfeld/

Duplicate #22519?

Please checkout #22923

Can you test it without this patch #21887. Does it work then as expected?

#21887 has nothing todo with that issue. As this just makes sure that $input is defined and if not does nothing. Please test #22942 by @ggppdk this looks like the correct fix @laoneo

Actually the error is thrown because of the new code of 21887,
but #21887 by itself is not wrong in its logic

• because indeed disabled fields are not posted

[EDIT]
code review and tested and the above the behavior of throwing error on disabled but posted fields pre-existed PR #21887, indeed PR #21887 is not related

and throwing error of disabled but posted elements is ok all form elements,
... except for form elements of com_fields array,
that is because fields of com_fields, as you know have the normalization code thing that sets a default of -false- for fields that are not posted (which is later used to make non-posted fields maintain their value)

So normalization code makes disabled fields appear as if they were posted ... which triggers the exception the invalid field exception because field should not exist in the request

Sorry looking at #21887 more , it seems to me that indeed it is not related,
the behavior i described above , indeed pre-existed PR #21887

i ll test previous code

As described above #21887 adds just a check if input is set do this the original change was from a security change just before that patch applied. But anyway this change seams to be correct. As disabled means no interaction and no data send by the browser. So when you disable a field it is not allowed that this field is in the post data. So read only is the correct way to fix it as this allows to send readonly fields and pass that check.

This should be fixed now with PR #22923