CVE-2026-27578: Typeorm Unscoped Or Idorcve-2026-27578-typeorm-unscoped-or-idor
An OR condition combining a broad global attribute check with a specific user context check was detected. In TypeORM, mixing unscoped properties with user identifiers using an array `where: [...]` or `.orWhere()` evaluates as an OR operator. This exposes all records matching the global attribute regardless of ownership, resulting in an Insecure Direct Object
