CVE-2026-56778: Typeorm Unscoped Or Authorization Bypasscve-2026-56778-typeorm-unscoped-or-authorization-bypass
A TypeORM query uses an array for the 'where' option or a Brackets query builder translating to a logical OR in SQL. One of the conditions introduces a user/tenant scoping variable (e.g., userId), while the other lacks it. This permits authorization bypass (IDOR) where an attacker can access globally scoped records if they satisfy the unscoped condition. Ens
