CVE-2026-2207: Meteor Publish Unauthorized Id Aggregationcve-2026-2207-meteor-publish-unauthorized-id-aggregation
A Meteor publish function aggregates items into an array without conducting an authorization check involving the user ID (e.g., `this.userId`). If this array is used to fetch related items, it can lead to Insecure Direct Object Reference (IDOR) and data leakage. Add an explicit authorization check inside the iteration loop or ensure the initial query correct
