[GHSA] GHSA-xxpx-f366-4xpq (medium) — Craft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element

GHSA-xxpx-f366-4xpq Severity: medium CVE: None

Craft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element

A control-panel user who holds only the viewCategories permission for a category group (and not saveCategories) can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-ele