ApiQueryRecentChanges checks only for 'patrol' permission, when rcprop=patrolled is given, instead it should use $wgUser->useRCPatrol(), which checks all related rights.
Version: 1.14.x
Severity: trivial
URL: http://en.wikipedia.org/w/api.php?action=query&list=recentchanges&rcprop=patrolled