An authorization bypass exists in the `ydoc:document:join` Socket.IO handler. The handler only performs ownership checks when the `document id` variable starts with the prefix `note:` (colon). However, the `YdocManager` storage layer normalizes all document IDs by replacing colons with underscores. An attacker can bypass the authorization check by requesting a document using `note <id>` (underscore) instead of `note:<id>` (colon), allowing them to access the same underlying Yjs document. This results in the server returning the full document state and leaking the private note contents of other users.