diff --git a/administrator/components/com_banners/models/banner.php b/administrator/components/com_banners/models/banner.php
index 16e3b8e6cbe87..866885bfafbc9 100644
--- a/administrator/components/com_banners/models/banner.php
+++ b/administrator/components/com_banners/models/banner.php
@@ -473,6 +473,27 @@ protected function prepareTable($table)
 		$table->version++;
 	}
 
+	/**
+	 * Allows preprocessing of the JForm object.
+	 *
+	 * @param   JForm   $form   The form object
+	 * @param   array   $data   The data to be merged into the form object
+	 * @param   string  $group  The plugin group to be executed
+	 *
+	 * @return  void
+	 *
+	 * @since    3.6.1
+	 */
+	protected function preprocessForm(JForm $form, $data, $group = 'content')
+	{
+		if ($this->canCreateCategory())
+		{
+			$form->setFieldAttribute('catid', 'allowAdd', 'true');
+		}
+
+		parent::preprocessForm($form, $data, $group);
+	}
+
 	/**
 	 * Method to save the form data.
 	 *
@@ -498,7 +519,7 @@ public function save($data)
 		}
 
 		// Save New Category
-		if ($catid == 0)
+		if ($catid == 0 && $this->canCreateCategory())
 		{
 			$table              = array();
 			$table['title']     = $data['catid'];
@@ -537,4 +558,16 @@ public function save($data)
 
 		return parent::save($data);
 	}
+
+	/**
+	 * Is the user allowed to create an on the fly category?
+	 *
+	 * @return  bool
+	 *
+	 * @since   3.6.1
+	 */
+	private function canCreateCategory()
+	{
+		return JFactory::getUser()->authorise('core.create', 'com_banners');
+	}
 }
diff --git a/administrator/components/com_banners/models/forms/banner.xml b/administrator/components/com_banners/models/forms/banner.xml
index 8a8dac3b9e32a..c4c182bace0ce 100644
--- a/administrator/components/com_banners/models/forms/banner.xml
+++ b/administrator/components/com_banners/models/forms/banner.xml
@@ -39,7 +39,6 @@
 			extension="com_banners"
 			required="true"
 			addfieldpath="/administrator/components/com_categories/models/fields"
-			allowAdd="true"
 			default=""
 		/>
 
diff --git a/administrator/components/com_contact/models/contact.php b/administrator/components/com_contact/models/contact.php
index a53da18198dcb..9783c5b62e140 100644
--- a/administrator/components/com_contact/models/contact.php
+++ b/administrator/components/com_contact/models/contact.php
@@ -396,7 +396,7 @@ public function save($data)
 		}
 
 		// Save New Category
-		if ($catid == 0)
+		if ($catid == 0 && $this->canCreateCategory())
 		{
 			$table = array();
 			$table['title'] = $data['catid'];
@@ -512,9 +512,28 @@ protected function getReorderConditions($table)
 	 * @param   string  $group  Group name.
 	 *
 	 * @return  void
+	 *
+	 * @since   3.0.3
 	 */
 	protected function preprocessForm(JForm $form, $data, $group = 'content')
 	{
+		// Determine correct permissions to check.
+		if ($this->getState('contact.id'))
+		{
+			// Existing record. Can only edit in selected categories.
+			$form->setFieldAttribute('catid', 'action', 'core.edit');
+		}
+		else
+		{
+			// New record. Can only create in selected categories.
+			$form->setFieldAttribute('catid', 'action', 'core.create');
+		}
+
+		if ($this->canCreateCategory())
+		{
+			$form->setFieldAttribute('catid', 'allowAdd', 'true');
+		}
+
 		// Association content items
 		$assoc = JLanguageAssociations::isEnabled();
 
@@ -633,4 +652,16 @@ protected function generateNewTitle($category_id, $alias, $name)
 
 		return array($name, $alias);
 	}
+
+	/**
+	 * Is the user allowed to create an on the fly category?
+	 *
+	 * @return  bool
+	 *
+	 * @since   3.6.1
+	 */
+	private function canCreateCategory()
+	{
+		return JFactory::getUser()->authorise('core.create', 'com_contact');
+	}
 }
diff --git a/administrator/components/com_contact/models/forms/contact.xml b/administrator/components/com_contact/models/forms/contact.xml
index f21b7307d01d0..3aa3bd386037f 100644
--- a/administrator/components/com_contact/models/forms/contact.xml
+++ b/administrator/components/com_contact/models/forms/contact.xml
@@ -75,7 +75,6 @@
 			description="JFIELD_CATEGORY_DESC"
 			extension="com_contact"
 			required="true"
-			allowAdd="true"
 			default=""
 		/>
 
diff --git a/administrator/components/com_content/models/article.php b/administrator/components/com_content/models/article.php
index 01656c6429418..8f288c5722c49 100644
--- a/administrator/components/com_content/models/article.php
+++ b/administrator/components/com_content/models/article.php
@@ -504,8 +504,8 @@ public function save($data)
 			$catid = CategoriesHelper::validateCategoryId($data['catid'], 'com_content');
 		}
 
-		// Save New Category
-		if ($catid == 0)
+		// Save New Categoryg
+		if ($catid == 0 && $this->canCreateCategory())
 		{
 			$table = array();
 			$table['title'] = $data['catid'];
@@ -723,9 +723,7 @@ protected function getReorderConditions($table)
 	}
 
 	/**
-	 * Auto-populate the model state.
-	 *
-	 * Note. Calling getState in this method will result in recursion.
+	 * Allows preprocessing of the JForm object.
 	 *
 	 * @param   JForm   $form   The form object
 	 * @param   array   $data   The data to be merged into the form object
@@ -737,8 +735,12 @@ protected function getReorderConditions($table)
 	 */
 	protected function preprocessForm(JForm $form, $data, $group = 'content')
 	{
+		if ($this->canCreateCategory())
+		{
+			$form->setFieldAttribute('catid', 'allowAdd', 'true');
+		}
+
 		// Association content items
-		$app = JFactory::getApplication();
 		$assoc = JLanguageAssociations::isEnabled();
 
 		if ($assoc)
@@ -809,4 +811,16 @@ public function hit()
 	{
 		return;
 	}
+
+	/**
+	 * Is the user allowed to create an on the fly category?
+	 *
+	 * @return  bool
+	 *
+	 * @since   3.6.1
+	 */
+	private function canCreateCategory()
+	{
+		return JFactory::getUser()->authorise('core.create', 'com_content');
+	}
 }
diff --git a/administrator/components/com_content/models/forms/article.xml b/administrator/components/com_content/models/forms/article.xml
index e3d3df72a2914..796fb16005472 100644
--- a/administrator/components/com_content/models/forms/article.xml
+++ b/administrator/components/com_content/models/forms/article.xml
@@ -47,7 +47,6 @@
 			label="JCATEGORY"
 			   description="JFIELD_CATEGORY_DESC"
 			required="true"
-			   allowAdd="true"
 			   default=""
 		>
 		</field>
diff --git a/administrator/components/com_newsfeeds/models/forms/newsfeed.xml b/administrator/components/com_newsfeeds/models/forms/newsfeed.xml
index 9667e3f405376..49444229a3684 100644
--- a/administrator/components/com_newsfeeds/models/forms/newsfeed.xml
+++ b/administrator/components/com_newsfeeds/models/forms/newsfeed.xml
@@ -54,7 +54,6 @@
 			description="COM_NEWSFEEDS_FIELD_CATEGORY_DESC"
 			extension="com_newsfeeds"
 			required="true"
-			allowAdd="true"
 			default=""
 		/>
 
diff --git a/administrator/components/com_newsfeeds/models/newsfeed.php b/administrator/components/com_newsfeeds/models/newsfeed.php
index 728a90dfe9e3b..b7da83fda3f4e 100644
--- a/administrator/components/com_newsfeeds/models/newsfeed.php
+++ b/administrator/components/com_newsfeeds/models/newsfeed.php
@@ -314,7 +314,7 @@ public function save($data)
 		}
 
 		// Save New Category
-		if ($catid == 0)
+		if ($catid == 0 && $this->canCreateCategory())
 		{
 			$table = array();
 			$table['title'] = $data['catid'];
@@ -503,9 +503,14 @@ protected function getReorderConditions($table)
 	 */
 	protected function preprocessForm(JForm $form, $data, $group = 'content')
 	{
+		if ($this->canCreateCategory())
+		{
+			$form->setFieldAttribute('catid', 'allowAdd', 'true');
+		}
+
 		// Association newsfeeds items
-		$app = JFactory::getApplication();
 		$assoc = JLanguageAssociations::isEnabled();
+
 		if ($assoc)
 		{
 			$languages = JLanguageHelper::getLanguages('lang_code');
@@ -568,4 +573,16 @@ protected function generateNewTitle($category_id, $alias, $name)
 
 		return array($name, $alias);
 	}
+
+	/**
+	 * Is the user allowed to create an on the fly category?
+	 *
+	 * @return  bool
+	 *
+	 * @since   3.6.1
+	 */
+	private function canCreateCategory()
+	{
+		return JFactory::getUser()->authorise('core.create', 'com_newsfeeds');
+	}
 }