{"id":"EUVD-2026-109083","enisaUuid":"3be707f6-dc34-3d46-abb6-188f95ab84dd","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/\u003ctype\u003e/\u003cname\u003e.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`\u0027s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.","datePublished":"Oct 23, 2026, 2:06:28 PM","dateUpdated":"Oct 23, 2026, 2:06:28 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-r3g7-r4hr-m258\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/978\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/99f7914ca0fbeed92e7c4d39cc8c3e5830dab133\nhttps://github.com/The-40-Thieves/obsidian-tc/blob/v1.31.4/CHANGELOG.md\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.31.4\n","aliases":"CVE-2026-115478\nGHSA-r3g7-r4hr-m258\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"4acba236-8549-3267-9827-709d42e9813d","product":{"name":"obsidian-tc","vendor":{"name":"The-40-Thieves"}},"product_version":"1.0.1, \u003c 1.31.4"}],"enisaIdVendor":[{"id":"412a4c8a-60e3-31b3-b645-0f705b6001bf","vendor":{"name":"The-40-Thieves"}}],"enisaIdVulnerability":[{"id":"3717cb57-e1c4-30be-9749-5e391d943acf","vulnerability":{"id":"GHSA-r3g7-r4hr-m258","description":"obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes","datePublished":"Oct 23, 2026, 6:47:25 PM","dateUpdated":"Oct 23, 2026, 6:47:39 PM","baseScore":0.0,"references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-r3g7-r4hr-m258\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115478\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/978\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/99f7914ca0fbeed92e7c4d39cc8c3e5830dab133\nhttps://github.com/The-40-Thieves/obsidian-tc\nhttps://github.com/The-40-Thieves/obsidian-tc/blob/v1.31.4/CHANGELOG.md\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.31.4\n","enisa_id":"EUVD-2026-109083\n","aliases":"GHSA-r3g7-r4hr-m258\nCVE-2026-115478\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:36 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6a12ca3e-59e6-3b94-bd77-151fdce5eeb6","vulnerability":{"id":"CVE-2026-115478","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/\u003ctype\u003e/\u003cname\u003e.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`\u0027s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.","datePublished":"Oct 23, 2026, 2:06:28 PM","dateUpdated":"Oct 23, 2026, 2:06:28 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-r3g7-r4hr-m258\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/978\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/99f7914ca0fbeed92e7c4d39cc8c3e5830dab133\nhttps://github.com/The-40-Thieves/obsidian-tc/blob/v1.31.4/CHANGELOG.md\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.31.4\n","enisa_id":"EUVD-2026-109083\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 27, 2026, 7:15:10 AM","vulnerabilityProduct":[{"id":"70fd3247-a280-32f3-a3b7-5ee7f15220d6","product":{"name":"obsidian-tc","vendor":{"name":"The-40-Thieves"}},"product_version":"1.0.1, \u003c 1.31.4"}],"vulnerabilityVendor":[{"id":"d158e3ea-085f-3acd-add3-cfa8de5f5d17","vendor":{"name":"The-40-Thieves"}}]}}],"enisaIdAdvisory":[]}