AIKIDO-2026-10476

TL;DR

Affected versions of this package are affected by an authorization audit trail inconsistency in comment deletion, where deleting a comment as its owner could succeed through an ownership fallback while the CASL check incorrectly logged the action as denied. It can cause misleading security logs and hinder incident investigation by masking legitimate ownership-based deletions as failed authorization attempts. An attacker with ownership over a comment could exploit this behavior to delete their own content while leaving an inaccurate audit record, potentially confusing reviewers, obscuring accountability, or interfering with forensic analysis of moderation and access control events.