NodeBB / NodeBB / 29118148155 / 2

85%

master: 85%

push

github

fix(topics): require topics:read on source category for owner topic moves

Topic owners could move topics from restricted categories to public
categories after losing topics:read access, exposing private replies
to guests.

Add a source-read check in the owner path of topicsAPI.move() to
prevent this. Admins and moderators of both source and destination
categories are unaffected.

Assisted-by: unsloth/Qwen3.6-27B-GGUF

12968 of 17949 branches covered (72.25%)

27451 of 32315 relevant lines covered (84.95%)

1523.26 hits per line