Unauthorized category moves via unchecked parent context

Improper privilege management in Moodle LMS allows remote authenticated users to move course categories across permission boundaries. The core_course_external::update_categories method checked moodle/category:manage only in the category's current context and accepted a new parent without validating the destination context. Exploitation requires an account that can manage the source category; it enables unauthorized restructuring under a parent the account cannot manage.