TrailBase: Insecure direct object reference in std.FileUpload (CVE-2026-119759)

TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes, trigger permanent deletion of the victim's file, or use a $like filter on the file column to brute-force recover stripped ids character by character.