CVE-2026-59237: Laravel Ungrouped Or Where Scoping Bypasscve-2026-59237-laravel-ungrouped-or-where-scoping-bypass
Chaining `orWhere` directly after `where` scoping conditions without grouping them in a closure can bypass multi-tenant or authorization scoping due to SQL operator precedence (AND evaluated before OR). Group OR conditions using `where(function ($query) { $query->where(...)->orWhere(...); })`.
