Redmine

Reading a project's issue categories requires manage_categories, which is asymmetric with versions, where the reads belong to view_issues and only the writes sit behind manage_versions.

GET /projects/:id/issue_categories.:format is the only way an API client can discover a project's categories, e.g. to offer the same "filter by category" the issue list offers, or to assign a category when creating an issue. Today that returns 403 unless the user may also create, rename and delete categories — and manage_categories is :require => :member, so non-members are refused even on public projects where they can see every issue.

Category names are already visible to everyone with view_issues, both on the issues themselves and as the values of the category_id filter in IssueQuery, so no new information is disclosed by the suggested change, which is to add the read actions to view_issues.

Note: the HTML index/show actions only redirect to project settings, so a view_issues-only user now gets the 403 after that redirect rather than immediately. Same outcome, and the API is the only real consumer, so the controller is unchanged.