CVE-2026-77362
Received Received - Intake

Obsidian-tc Read ACL Bypass in Tasks Filter

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-77362
EUVD
EUVD-2026-98689

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The-40-Thieves obsidian-tc < 1.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in obsidian-tc versions prior to 1.3.1 allows authenticated users to infer or read data from notes outside their read access-control list (ACL) through three bridge tools: tasks_filter, makemd_query, and list_templates. These tools leaked sensitive information by not consistently applying the read ACL to all returned fields.

Impact Analysis

An attacker with low privileges could access unauthorized data by exploiting the exposed fields in tasks_filter, makemd_query, or list_templates. This includes counts of restricted notes, unfiltered sibling fields, or template paths and user-function bodies.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade obsidian-tc to version 1.3.1 or later to apply the security fix. Alternatively, disable the affected bridge tools tasks_filter, makemd_query, and list_templates as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart