Steps to reproduce the issue

I haven't been able to reproduce it yet on a fresh 3.7.2 install

System information (as much as possible)

PHP 5.6, Centos 6.x latest, Joomla 3.7.2

This Joomla has been migrated and updated since 1.6

Additional comments

I have a hierarchical category structure with access levels and groups for each level.

I create a List All Categories menu item which points to a parent level, with an appropriate access level (let's call it P). Inside are additional subcategories, (S1, S2, S3, etc.) with matching access levels. Inside the subcategories are articles, with have their category's subcategory access level.

Before 3.7, the menu item, when clicked, would show only subcategories which the user has access to. The user in 3.7 sees all subcategories, regardless if they have access. If they click on a subcategory link they don't have access to, they get a forbidden error (correctly).

So, the problem is clearly in the view of the parent category, showing children regardless of access levels the user is related to.

I have shown this in the SQL commands as follows:

https://gist.github.com/kpmueller/df426df43a3d1199bb97b0e6aa40861a

This is one of the subcategory queries. In the query, it is limiting itself by access level.

  LEFT JOIN j25_content_rating AS v 
  ON a.id = v.content_id

  WHERE a.access IN (1,1,4,5,6,41,89,218,285,287,313,329,367) 
  AND c.access IN (1,1,4,5,6,41,89,218,285,287,313,329,367) 
  AND c.published = 1 

https://gist.github.com/kpmueller/f87a9cd9047066ef20a2295e3fc6536a

This is the parent category query (from the List All Categories menu item). It has NO access level clause.

  LEFT JOIN `j25_content` AS i 
  ON i.`catid` = c.id 
  AND i.state = 1

  WHERE (c.extension='com_content' OR c.extension='system') 
  AND c.published = 1 
  AND s.id=176

The stack trace involved:

https://gist.github.com/kpmueller/06a7a59900416974556587a786b6c0d8

I believe this should be set, here: libraries/legacy/categories/categories.php:236

                if ($this->_options['access'])
                {
                        $query->where('c.access IN (' . implode(',', $user->getAuthorisedViewLevels()) . ')');
                }

But, it seems there's not an _options['access'] setting in the model.

Earlier in the stack:

components/com_content/models/category.php:355

                        if (isset( $this->state->params))
                        {
                                $params = $this->state->params;
                                $options = array();
                                $options['countItems'] = $params->get('show_cat_num_articles', 1) || !$params->get('show_empty_categories_cat', 0);
                                $options['access']     = $params->get('check_access_rights', 1);
                        }
                        else
                        {
                                $options['countItems'] = 0;
                        }

There should be an options['access'] being set, based on a parameter, check_access_rights. For some reason, this is not happening.

This seems potentially to be related to an earlier PR, #11624

Unfortunately, I tried to reproduce this with a fresh joomla, and it seemed to be working properly, so I wonder if some kind of migrated data is involved. Nothing looked out of place. There must be somewhere further up where a parameter is not properly set, or lost?

If i can provide any more information, please let me know. I don't really know where to look next.