Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse allows trusted users (TL4) to post topics in staff-only categories by using a scheduled topic timer feature, bypassing the intended access restrictions. This lets unauthorized users create content in restricted areas.

TL4 users can bypass authorization checks in Discourse by leveraging the `publish_to_category` topic timer mechanism to publish topics into staff-only categories. The vulnerability stems from insufficient permission validation during the topic timer execution, allowing privilege escalation to restricted content areas.