I added ‘.csv’ to the “Authorized Extensions” list on our site, and then went back to a topic I had previously I opened. I clicked the topic-level Reply button, and then clicked the ‘upload’ button. After selecting a CSV file to upload, I was told that it was not allowed.
I then force-refreshed the page, and tried again. This time the upload was accepted.
Later (at least 10 minutes), I tried to upload a CSV again, into a new post in the same topic, and was once again told it was not allowed. Again a force-refresh solved the problem. No changes were made in the Admin panel between these two posts.
Our site is hosted by the Discourse team, so it might have multiple instances that are load-sharing, which could explain why the problem reappeared even though the Admin settings had not been changed.