Two actions in the category UI don't have security visibility checks: reorder categories and assign template.
Closing old tickets