CVE-2026-42230: Typeorm Potential Idor Or Condition
A TypeORM `where` array or `orWhere` statement includes a static condition alongside a user access parameter. This acts as an OR in SQL and might unintentionally expose all rows matching the static condition regardless of ownership boundaries.
Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0
TS
TSgreprules fetch cve-2026-42230-typeorm-potential-idor-or-condition --engine opengrepDescription
A TypeORM `where` array or `orWhere` statement includes a static condition alongside a user access parameter. This acts as an OR in SQL and might unintentionally expose all rows matching the static condition regardless of ownership boundaries.
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0