From 1c8667eae8b28739e43569b612ffdb2693c6b1ce Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Thu, 19 Feb 2026 23:25:39 +0200
Subject: [PATCH] Fix GHSL-2026-035_Wekan.

Thanks to GHSL and xet7 !
---
 server/publications/notifications.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/server/publications/notifications.js b/server/publications/notifications.js
index bc6998a4c..556f5948d 100644
--- a/server/publications/notifications.js
+++ b/server/publications/notifications.js
@@ -130,7 +130,14 @@ Meteor.publish('notificationUsers', async function() {
           .filter(v => !!v),
       },
     },
-    {},
+    {
+      fields: {
+        username: 1,
+        'profile.fullname': 1,
+        'profile.avatarUrl': 1,
+        'profile.initials': 1,
+      },
+    },
     true,
   );
   return ret;