Severity: LOW
Location: src/Controllers/ForumController.php:1438
Bug: No existence check before toggle.
Fix: Validate target existence first.
Status: open. Will reply with remediation details when resolved.
[L-7] toggleSubscription creates orphan rows for non-existent forums/threads
Resolved.
ForumController::toggleSubscription now resolves the thread/forum id, looks up the parent forum, and rejects with a 404 unless Forum::canView passes and Forum::isPreviewOnly returns false.
A brute-force subscribe against private-forum thread IDs no longer silently succeeds, so the notification fan-out can't leak reply excerpts from hidden forums.
Also resolves L-7 (orphan subscription rows for nonexistent targets) — we now findById before calling toggle, so invalid ids return 404 and no row is written.
Locking this thread.