How critical is SA-CORE-2018-005? The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability or is it about accessing restricted content?

Ref.

https://www.drupal.org/SA-CORE-2018-005

https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.

The rewrite happens early, so the access layer in Drupal/Symfony runs as intended. But it bypasses path-based restrictions that happen earlier ("on higher level caches and web servers", according to the CVE at https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers).

For example, if you use .htaccess to restrict /admin/* from outside your IP range, that might be bypassed, but Drupal's own access system will still work as it should.