Information Disclosure ever after CVE-2020-14179/JRASERVER-71536

h3. Issue Summary
Unauthorized access to data from the following API even if the public.access.disabled is enabled.
/rest/api/2/projectCategory
/rest/api/2/resolution
/rest/menu/latest/admin

h3. Steps to Reproduce

• Install Jira 8.13.9 with H2 database
• Create a project and some Project categories
• Run the API call “http://localhost:48139/j8139/rest/api/2/projectCategory” without the username and password.

h3. Expected Results

• Unauthorised access and the data should not be visible.

h3. Actual Results

• Project categories, resolutions, and usernames are listed even if the API is not authenticated

h3. Workaround
Currently, there is no known workaround for this behavior. A workaround will be added here when available