1. Create a user (A) and add to user group that can create and edit items on specific category
2. This user (A) creates a new article in the frontend - category list is restricted as it should be
3. User (A) saves item
4. This article is then published by another user (B)
5. User (A) re-edits the article - category list is NOT resctricted.

Line 450 of components/com_k2/views/item/view.html.php should read

if (($task == 'add' || $task =='edit') && !$user->authorize('com_k2', 'add', 'category', 'all')) {

to correct this problem