CVE-2026-77362

Awaiting Analysis Awaiting Analysis - Queue

Obsidian-tc Read ACL Bypass in Tasks Filter

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77362

EUVD

EUVD-2026-98689

Affected Vendors & Products

Vendor	Product	Version / Range
The-40-Thieves	obsidian-tc	< 1.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in obsidian-tc versions prior to 1.3.1 allows authenticated users to infer or read data from notes outside their read access-control list (ACL) through three bridge tools: tasks_filter, makemd_query, and list_templates. These tools leaked sensitive information by not consistently applying the read ACL to all returned fields.

Detection Guidance

To detect this vulnerability, check if your obsidian-tc instance is running a version prior to 1.3.1. Use commands like 'npm list obsidian-tc' or inspect the version in your configuration files. Monitor logs for unauthorized data exposure from tools tasks_filter, makemd_query, and list_templates.

Impact Analysis

An attacker with low privileges could access unauthorized data by exploiting the exposed fields in tasks_filter, makemd_query, or list_templates. This includes counts of restricted notes, unfiltered sibling fields, or template paths and user-function bodies.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade obsidian-tc to version 1.3.1 or later to apply the security fix. Alternatively, disable the affected bridge tools tasks_filter, makemd_query, and list_templates as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-77362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70