Users with the moderate_comments permission should be allowed to view comments that are not attached to a Post.

What happens now

GET Comments Collection:

We don't check that the comment_post_ID !==0 in WP_REST_Comments_Controller->get_items() before checking the read post permission anyone that even has comments without a post relationship gets this response:

[ ]

No error, just an empty response with a PHP Notice in their log about trying to get the property on a non-object.

GET Single Comment

$post = get_post( $comment->comment_post_ID );
        if ( empty( $post ) ) {
            return new WP_Error( 'rest_post_invalid_id', __( 'Invalid post id.' ), array( 'status' => 404 ) );
        }