diff --git a/api4/channel_category.go b/api4/channel_category.go
index e14a0f13cb..b9bf68009b 100644
--- a/api4/channel_category.go
+++ b/api4/channel_category.go
@@ -52,19 +52,19 @@ func createCategoryForTeamForUser(c *Context, w http.ResponseWriter, r *http.Req
 	auditRec := c.MakeAuditRecord("createCategoryForTeamForUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
 
-	var categoryCreateRequest *model.SidebarCategoryWithChannels
+	var categoryCreateRequest model.SidebarCategoryWithChannels
 	err := json.NewDecoder(r.Body).Decode(&categoryCreateRequest)
 	if err != nil || c.Params.UserId != categoryCreateRequest.UserId || c.Params.TeamId != categoryCreateRequest.TeamId {
 		c.SetInvalidParam("category")
 		return
 	}
 
-	if appErr := validateSidebarCategory(c, c.Params.TeamId, c.Params.UserId, categoryCreateRequest); appErr != nil {
+	if appErr := validateSidebarCategory(c, c.Params.TeamId, c.Params.UserId, &categoryCreateRequest); appErr != nil {
 		c.Err = appErr
 		return
 	}
 
-	category, appErr := c.App.CreateSidebarCategory(c.Params.UserId, c.Params.TeamId, categoryCreateRequest)
+	category, appErr := c.App.CreateSidebarCategory(c.Params.UserId, c.Params.TeamId, &categoryCreateRequest)
 	if appErr != nil {
 		c.Err = appErr
 		return
diff --git a/api4/channel_category_test.go b/api4/channel_category_test.go
index 586373eb83..b66aca4658 100644
--- a/api4/channel_category_test.go
+++ b/api4/channel_category_test.go
@@ -5,6 +5,7 @@ package api4
 
 import (
 	"encoding/json"
+	"fmt"
 	"testing"
 	"time"
 
@@ -90,6 +91,17 @@ func TestCreateCategoryForTeamForUser(t *testing.T) {
 		require.Equal(t, int64(10), customCategory.SortOrder)
 	})
 
+	t.Run("should not crash with null input", func(t *testing.T) {
+		require.NotPanics(t, func() {
+			user, client := setupUserForSubtest(t, th)
+			payload := []byte(`null`)
+			route := fmt.Sprintf("/users/%s/teams/%s/channels/categories", user.Id, th.BasicTeam.Id)
+			r, err := client.DoAPIPostBytes(route, payload)
+			require.Error(t, err)
+			closeBody(r)
+		})
+	})
+
 	t.Run("should publish expected WS payload", func(t *testing.T) {
 		t.Skip("MM-42652")
 		userWSClient, err := th.CreateWebSocketClient()