CVE-2026-49444: Typeorm Unscoped Personal Data Idorcve-2026-49444-typeorm-unscoped-personal-data-idor
Detected an unscoped TypeORM OR condition. Passing an array to the 'where' clause or using 'orWhere' executes an OR condition in SQL. If a branch only filters by an access level (like 'personal') without also checking a user identifier, it unintentionally exposes records belonging to all users instead of just the requesting user. Ensure private data queries
