Confusing situations can occur if someone manually edits forum urls. For example, if someone is looking at a forum topic, they can edit the topic id in the url to refer to another project. In this case they will see the messages for this unrelated topic appearing as if they are hosted in the wrong project. Authorization is still evaluated properly so it's not really a security concern, but it is very confusing. There needs to be some changes in the client made to the topic and messages lists to account for this issue.
Confusing situations can occur if someone manually edits forum urls. For example, if someone is looking at a forum topic, they can edit the topic id in the url to refer to another project. In this case they will see the messages for this unrelated topic appearing as if they are hosted in the wrong project. Authorization is still evaluated properly so it's not really a security concern, but it is very confusing. There needs to be some changes in the client made to the topic and messages lists to account for this issue.