Hmm for role based security I only have two ideas, one for back end and one for front end:

Back end:
While making a category or editing a category there must be a check box as to which user role can post in that category.
Front end:
While making a post there should be a check box at the bottom of the text editor to make it sticky or not, only for Admins n moderators.

Also there should be a small content box which can occupy the position below the category navigation in the home page, to display the rules of the community. Because all traditional forums have a separate category called "rules n regulations". But that is old fashioned.

Another thing is, try to remove "/forum" from URL structure, because it will not make sense for people who installs the software in a sub domain called forum, then URL will kook weird eg. forum.domain.com/forum/topic
So if u can remove that forum tag from URL, it will clean up the URL.

I have some big suggestions which I feel are the most significant for 2.5. Hope you do not mind me sharing them.

Inclusion of gallery upload option in the "upload popup box". Because what if a member wants to share, say 7 screenshots or pics from some movie or so he/she watched. Without a gallery all the images will get displayed in a list order, which will lengthen a post, so if u can provide a gallery option, it would make the posts look more elegant. BUT gallery means you SHOULD NOT include Jquery lightbox to display gallery images on-click, instead try utilising CSS3 lightbox. I once helped a person set up CSS3 lightbox for Wordpress see -> https://wordpress.org/plugins/css3lightbox/ . The logic is simple and avoids the use of all jquery and other bloat. This gallery will pose another problem, so for admins there should be an option for bandwidth management, like controlling the amount of mb an user can upload in one gallery. You do not have to integrate this option in the backend (because backends are always tougher than core modifications, so we can do it another time) , but make it available in the constants.php file under /sites/default/
In mobile view the post editor screen, when u click on "reply button" comes under the "notifications control panel - the panel where u can adjust the level of notifications" This is a bug since the post editor should always come immediately under the comment to which we are making the reply, This happens in Tabs and mobile, u can try resizing your browser window and u will see this bug in action.
Sitemaps and RSS should be enabled. If RSS is enabled then people can display their forum posts in other CMS using the RSS widget. RSS should contain a thumbnail of the post also, if the starting post in a topic has atleast one image.
Most importantly, when people are posting in a topic, if the new posts gets loaded in real time (eg. If u have used Disqus comment system, you can see when some one replies in a conversation, those new comments will get loaded automatically) That will give the users a sensation of being engaged in a real conversation. I know live notifications are already there. But trust me, sometimes, as you can see in FB groups and all, when more than 10-20 users are engaged in conversation, we loose track of notifications. BUT the question comes, "how much impact will it have on the host server" In the case of Disqus, they have dedciated servers to handle multiple requests. So it is better if this real time conversations feature is optional. Means if a person has VPS with more than 2GB ram and all he can enable it if his/her forum has large conversations taking place. This option can also be integrated in the constants.php file rather than in the backend GUI.
There are some other heavy concepts missing in other departments like personal message, friend requests and blocking friends etc. But if you ask me logically it is better not to make personal messages real time, because then as u already see in Facebook, people will prefer to chat with their friends rather than making posts in a group. So if at all you are considering personal messaging, it is better to make it not in real time, or else it will defeat the purpose of a "forum".
I know the script is already fast, but if it can make use of X-cache or other php opcode cacheer (I said X-cache, because it is easiest to install in VPS as compared to APC) , I donno may be it will accelerate codoforum a little bit more? O.o I don't know. Just my feeling

Hope this is not a pain to read such long suggestions. I know it will be impossible for you to implement all these features in next version it self (infact, no developer can do these much changes in one iteration of a script) so choose the most important from the above, preferably real time post replying and loading of other replies in a topic and gallery uploads and role based security.
@adesh @avinash