Fixed on master thanks for reporting.
I've just posted about security problem I believe exist in source code.
But I delete this post because I don't know if it was a good idea to write it in public.
Maybe admins can read that deleted post? Or I can just email it (to which address?)
@bogus "normal" users like us only see "This post is deleted!" but admins will see the post content, so it's ok.
Actual deleted post for reference https://community.nodebb.org/topic/4033/security-problem
Yeah I can see your deleted post and looking into it.
For future reference please send security issues you find to [email protected].