NodeBB / NodeBB / 29118148155 / 4

85%

master: 85%

push

github

fix(topics): require topics:read on source category for owner topic moves

Topic owners could move topics from restricted categories to public
categories after losing topics:read access, exposing private replies
to guests.

Add a source-read check in the owner path of topicsAPI.move() to
prevent this. Admins and moderators of both source and destination
categories are unaffected.

Assisted-by: unsloth/Qwen3.6-27B-GGUF

13245 of 18323 branches covered (72.29%)

27780 of 32724 relevant lines covered (84.89%)

698.34 hits per line