Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass

Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an authorization bypass in PostsControllerdisplaypost. The controller calls post.reverttoparams:version directly whenever a version query parameter is present, without checking whether the corresponding PostRevision is...