Index: src/wp-includes/capabilities.php
===================================================================
--- src/wp-includes/capabilities.php	(revision 39182)
+++ src/wp-includes/capabilities.php	(working copy)
@@ -297,8 +297,6 @@
 			break;
 		}
 
-		$caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );
-
 		$meta_key = isset( $args[1] ) ? $args[1] : false;
 
 		$has_filter = has_filter( "auth_{$object_type}_meta_{$meta_key}" ) || has_filter( "auth_{$object_type}_{$sub_type}_meta_{$meta_key}" );
@@ -314,6 +312,8 @@
 			}
 		} elseif ( $meta_key && is_protected_meta( $meta_key, $object_type ) ) {
 			$caps[] = $cap;
+		} else {
+			$caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );
 		}
 		break;
 	case 'edit_comment':
Index: src/wp-includes/meta.php
===================================================================
--- src/wp-includes/meta.php	(revision 39182)
+++ src/wp-includes/meta.php	(working copy)
@@ -1034,15 +1034,6 @@
 	$args = apply_filters( 'register_meta_args', $args, $defaults, $object_type, $meta_key );
 	$args = wp_parse_args( $args, $defaults );
 
-	// If `auth_callback` is not provided, fall back to `is_protected_meta()`.
-	if ( empty( $args['auth_callback'] ) ) {
-		if ( is_protected_meta( $meta_key, $object_type ) ) {
-			$args['auth_callback'] = '__return_false';
-		} else {
-			$args['auth_callback'] = '__return_true';
-		}
-	}
-
 	// Back-compat: old sanitize and auth callbacks are applied to all of an object type.
 	if ( is_callable( $args['sanitize_callback'] ) ) {
 		add_filter( "sanitize_{$object_type}_meta_{$meta_key}", $args['sanitize_callback'], 10, 3 );
Index: tests/phpunit/tests/meta/registerMeta.php
===================================================================
--- tests/phpunit/tests/meta/registerMeta.php	(revision 39182)
+++ tests/phpunit/tests/meta/registerMeta.php	(working copy)
@@ -4,9 +4,14 @@
  */
 class Tests_Meta_Register_Meta extends WP_UnitTestCase {
 	protected static $post_id;
+	protected static $users;
 
 	public static function wpSetUpBeforeClass( $factory ) {
 		self::$post_id = $factory->post->create();
+		self::$users = array(
+			'administrator' => $factory->user->create_and_get( array( 'role' => 'administrator' ) ),
+			'subscriber'        => $factory->user->create_and_get( array( 'role' => 'subscriber' ) ),
+		);
 	}
 
 	public function _old_sanitize_meta_cb( $meta_value, $meta_key, $meta_type ) {
@@ -74,7 +79,7 @@
 					'description' => '',
 					'single' => false,
 					'sanitize_callback' => null,
-					'auth_callback' => '__return_true',
+					'auth_callback' => null,
 					'show_in_rest' => false,
 				),
 			),
@@ -96,7 +101,7 @@
 					'description' => '',
 					'single' => false,
 					'sanitize_callback' => null,
-					'auth_callback' => '__return_true',
+					'auth_callback' => null,
 					'show_in_rest' => false,
 				),
 			),
@@ -148,7 +153,7 @@
 					'description' => '',
 					'single' => false,
 					'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ),
-					'auth_callback' => '__return_true',
+					'auth_callback' => null,
 					'show_in_rest' => false,
 				),
 			),
@@ -172,6 +177,45 @@
 		$this->assertEquals( 'new_sanitized_key new sanitized', $meta );
 	}
 
+	public function test_register_meta_with_new_auth_callback_parameter() {
+
+		wp_set_current_user(  self::$users['subscriber']->ID ); 
+		
+		register_meta( 'post', 'no_auth_cb_1', array() ); 
+		$subscriber_can_update = false; 
+		if( current_user_can( 'edit_post_meta', self::$post_id, 'no_auth_cb_1' ) ){ 
+		        $subscriber_can_update = update_post_meta( self::$post_id, 'no_auth_cb_1', 'bar1' ); 
+		} 
+		unregister_meta_key( 'post', 'no_auth_cb_1' ); 
+		$this->assertFalse( $subscriber_can_update ); 
+
+		register_meta( 'post', 'auth_cb_true', array( 'auth_callback' =>  '__return_true' ) ); 
+		$subscriber_can_update = false; 
+		if( current_user_can( 'edit_post_meta', self::$post_id, 'auth_cb_true' ) ){ 
+		        $subscriber_can_update = update_post_meta( self::$post_id, 'auth_cb_true', 'bar1' ); 
+		} 
+		unregister_meta_key( 'post', 'auth_cb_true' ); 
+		$this->assertNotEmpty( $subscriber_can_update ); 
+		
+		wp_set_current_user( self::$users['administrator']->ID );
+
+		register_meta( 'post', 'no_auth_cb_2', array() ); 
+		$admin_can_update = false; 
+		if( current_user_can( 'edit_post_meta', self::$post_id, 'no_auth_cb_2' ) ){ 
+		        $admin_can_update = update_post_meta( self::$post_id, 'no_auth_cb_2', 'bar2' ); 
+		} 
+		unregister_meta_key( 'post', 'no_auth_cb_2' ); 
+		$this->assertNotEmpty( $admin_can_update );
+	    
+		register_meta( 'post', 'auth_cb_false', array( 'auth_callback' => '__return_false' ) ); 
+		$admin_can_update = false; 
+		if( current_user_can( 'edit_post_meta', self::$post_id, 'auth_cb_false' ) ){ 
+		        $admin_can_update = update_post_meta( self::$post_id, 'auth_cb_false', 'bar2' ); 
+		} 
+		unregister_meta_key( 'post', 'auth_cb_false' ); 
+		$this->assertFalse( $admin_can_update ); 
+	}
+
 	public function test_register_meta_unregistered_meta_key_removes_sanitize_filter() {
 		register_meta( 'post', 'new_sanitized_key', array( 'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ) ) );
 		unregister_meta_key( 'post', 'new_sanitized_key' );