Custom Wizard bypasses category security settings and moderation queue

Support Discourse Custom Wizard
1

Environment

Discourse Version: 2026.6.0-latest

Plugin Commit: 0bb72d6

Steps to Reproduce

Hi Custom Wizard team,

I am reaching out to report an issue regarding category permissions and moderation bypass when using a Custom Wizard.

I have configured a wizard that acts as a post builder to create a topic upon completion. The issue I am experiencing is that anyone with the wizard’s URL can publish a topic in restricted categories, completely bypassing both the Discourse group security settings and the moderation queue.

______
My Setup

I have 2 categories. All of them have content moderation enabled (topics must be approved before being public):

  • Rome rapp ONU: Only the RomeHQ-staff group can create/reply. The RomeHQ-ro group is read-only.

  • Parigi Amb: Only the ParisAMB-staff group can create/reply. The ParisAMB-ro group is read-only.

______
Current Behavior (The Bug)

I have tested this with two different users:

  1. User luca-it (Belongs to the RomeHQ-ro group - should be read-only).

    • When using the wizard link, this user can successfully publish a topic in any of the 3 categories (Italia, Francia, or Germania).

    • The topic completely bypasses the moderation queue and becomes public immediately.

  2. User boss-it (Belongs to the RomeHQ-staff group - has posting rights only for the Italia category).

    • When using the wizard link, this user can also publish topics in all 3 categories.

    • The topic completely bypasses the moderation queue and becomes public immediately.

______
Expected Behavior

  • User luca-it should not be able to publish any topics at all via the wizard, as they belong to a read-only group.

  • User boss-it should only be able to create topics if they select the “Italia” category.

  • Any topic created by an authorized user (like boss-it) must go to the moderation queue and wait for approval, rather than being published immediately.

I have attached the JSON export of my wizard for your reference. Is there a specific configuration I am missing to enforce native Discourse permissions and moderation within the wizard, or is this a bug?

Logs