CVE-2026-116161: Javascript Query Identity Omits Constraints Beside Orcve-2026-116161-javascript-query-identity-omits-constraints-beside-or
A query representation is built from only the branches of a `$or` operator and returned as the query's identity. Every constraint stored beside `$or` (a server-injected per-user ownership pointer or a beforeSubscribe/tenant filter) is silently dropped, so distinct subscriptions collapse to the same key, are merged into one subscription group, and events (inc
