From a34c2f35a6c4ae64b97af0a930fb768b2d781938 Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Fri, 20 Feb 2026 00:28:33 +0200
Subject: [PATCH] Fix Notifications from not allowed Boards.

Thanks to FK-PATZ3 and xet7 !

Fixes #6103
---
 models/activities.js |  5 ++++-
 models/cards.js      | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/models/activities.js b/models/activities.js
index 6594ef620..d27edcade 100644
--- a/models/activities.js
+++ b/models/activities.js
@@ -363,12 +363,12 @@ if (Meteor.isServer) {
       if (value) params[key] = value;
     });
     if (board) {
+      const activeMemberIds = _.filter(board.members || [], m => m.isActive === true).map(m => m.userId);
       const BIGEVENTS = process.env.BIGEVENTS_PATTERN; // if environment BIGEVENTS_PATTERN is set, any activityType matching it is important
       if (BIGEVENTS) {
         try {
           const atype = activity.activityType;
           if (new RegExp(BIGEVENTS).exec(atype)) {
-            const activeMemberIds = _.filter(board.members, m => m.isActive === true).map(m => m.userId);
             watchers = _.union(watchers, activeMemberIds); // notify all active members for important events
           }
         } catch (e) {
@@ -393,6 +393,9 @@ if (Meteor.isServer) {
           _.intersection(participants, trackingUsers),
         );
       }
+
+      // Ensure notifications only go to active members of the current board.
+      watchers = _.intersection(watchers, activeMemberIds);
     }
     (await Notifications.getUsers(watchers)).forEach((user) => {
       // Skip if user is undefined or doesn't have an _id (e.g., deleted user or invalid ID)
diff --git a/models/cards.js b/models/cards.js
index 290447ada..d6fc1fa21 100644
--- a/models/cards.js
+++ b/models/cards.js
@@ -2098,6 +2098,10 @@ Cards.helpers({
       );
 
       const newBoard = ReactiveCache.getBoard(boardId);
+      const allowedMemberIds = _.pluck(
+        _.filter(newBoard.members || [], member => member.isActive === true),
+        'userId',
+      );
       const newBoardLabels = newBoard.labels;
       const newCardLabelIds = _.pluck(
         _.filter(newBoardLabels, label => {
@@ -2119,6 +2123,18 @@ Cards.helpers({
       if (!Array.isArray(mutatedFields.customFields)) {
         mutatedFields.customFields = [];
       }
+
+      const currentMembers = Array.isArray(this.members) ? this.members : [];
+      const filteredMembers = currentMembers.filter(memberId => allowedMemberIds.includes(memberId));
+      if (_.difference(currentMembers, filteredMembers).length > 0) {
+        mutatedFields.members = filteredMembers;
+      }
+
+      const currentWatchers = Array.isArray(this.watchers) ? this.watchers : [];
+      const filteredWatchers = currentWatchers.filter(watcherId => allowedMemberIds.includes(watcherId));
+      if (_.difference(currentWatchers, filteredWatchers).length > 0) {
+        mutatedFields.watchers = filteredWatchers;
+      }
     }
 
     Cards.updateAsync(this._id, { $set: mutatedFields });