Resolved PM flags return 404 for moderators after upgrade, making past moderation history inaccessible

Contribute Bug

AI-generated summary

littleD reports a bug introduced in a recent Discourse upgrade (from 2026-05 to 2026-11) where moderators can no longer access resolved Personal Message (PM) flags. Previously, even though moderators could not open the actual PM conversation after a flag was resolved, they could still view the /review/ID page to see moderation history and details about the reported violation. Now, this page returns a 404 error because the moderators are not participants in the PM thread.

The issue appears linked to the security update “Scope PM reviewables to their allowed audience.” The user understands the need to restrict access to private conversations but notes that losing the review item entirely hinders the ability to investigate repeat violations or understand past moderation decisions. Since the review pages were accessible before the upgrade, moderators had no reason to manually copy information into User Notes, leaving them with no retrospective way to review these historical cases.

The post asks if this loss of access is an intended consequence and seeks a supported method for moderators to review existing, resolved PM flags that are now inaccessible.

1

After upgrading from a 2026-05 build to a 2026-11 build, I noticed a change affecting resolved flags on personal messages.

Our moderators are generally not participants in the reported PM conversations:

  1. While a PM flag is pending, moderators can review and handle it.
  2. After it is resolved, once the moderator no longer has access to the PM, /review/ID returns 404.
  3. This also prevents access to the review item’s moderation history and the information needed to understand the reported violation.

Previously, moderators could no longer open the PM conversation after resolving the flag, but the review page still provided enough information to understand what had been reported and how it was handled.

This seems related to SECURITY: Scope PM reviewables to their allowed audience.

I understand the reason for restricting access to private conversations. However, losing access to the entire review item makes it difficult to investigate repeat violations and understand earlier moderation decisions.

User Notes could help document future cases, but they do not solve the retrospective problem. Many reports were handled before the upgrade, when their review pages remained accessible. Moderators therefore had no reason to manually copy the relevant information into separate notes.

Is making the entire resolved review item inaccessible an intended consequence of this change? And is there a supported way for moderators to review these existing cases?