AIKIDO-2026-645757

TL;DR

The SQL query builder compiles an empty $or array to no predicate at all instead of an always-false condition, so the intended restriction disappears from the generated SQL. Reads then return every row, and nativeDelete and nativeUpdate operate on the whole table, while $not and having variants emit invalid SQL. An application that builds an allow-list filter that can produce an empty $or fails open silently rather than matching nothing. The fix makes an empty $or compile to a false condition so the query matches no rows.