GHSA-XXPX-F366-4XPQ Craft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element

A control-panel user who holds only the viewCategories permission for a category group and not saveCategories can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoi...