It's now possible for anyone to join a Collective™ and make a draft article. Links to draft articles 404 for those without the proper access, but the /posts/:id/revisions
route doesn't respect the draft status of an article and displays the revisions list even for drafts. For example, /posts/71632829/revisions shows my draft Collective™ article. This route should instead 404 for drafts.
Aside from leaking the contents of article drafts, this could also be abused by spammers to post spam in an essentially unmoderated way: there is no way to flag articles from the revisions page (or from any page for that matter, but hopefully approved and published articles won't be spam), so one could abuse this bug to host spam on SO in a relatively unnoticed way.