AFor old PRs part please see https://developer.joomla.org/joomlacode-archive/

Thank you @wojsmol
But I can not find an entry "ACL Issues when user has edit (but not create) permission in…" in joomlacode-archive. What is my mistake?
I can see the changed files here: 467c3dc
But I can not see the conversation. If I click on the issue link an other PR is opend - a newer one with the same number #27766.

To understand your question: which check would you expect?

I assume, the permission will follow the default behaviour: component => category => item and as the item has no ACL, it sticks to the category.

I only can see that the banners themselves i.e. the table #__banners has no field asset_id. So if someone may edit a category it is assumed that he can edit also the banners.
Maybe that this code was written before Joomla was on github.

https://developer.joomla.org/joomlacode-archive/issue-27766.html

The reason is exactly as @chmst wrote. Since there is no asset tracking on item level (which is the case for eg banners), the next best thing is checking the assigned category.
I use the same behavior in my extension for the same reason.

@astridx is still an issue?

I think I understood it now. There is no special reason why there is no asset tracking in com_contact and com_banners at item level. It's just not implemented. Correct?

Most likely one didn't see any advantage for item permissions at the time. As long as you don't need to allow edits for a single banner (or contact) only, it is sufficient to track it on category level.