Moderator privilege escalation via arbitrary post identifier

Improper privilege management in affected Discourse releases allows remote authenticated users with moderator access to edit protected site policy documents. The suspend and silence endpoint accepts an arbitrary post_id and uses it without enforcing the special edit restriction on Terms of Service, guidelines, and privacy-policy posts. A moderator account and a crafted request are required; the bounded consequence is unauthorized modification of those public policy documents.