{"id":"EUVD-2026-98689","enisaUuid":"30c42874-d351-3cae-b20a-58a661d0d871","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller\u0027s read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.","datePublished":"Oct 13, 2026, 2:00:11 PM","dateUpdated":"Oct 13, 2026, 2:50:19 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/75\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1\n","aliases":"CVE-2026-77362\nGHSA-43r2-c7g8-prc8\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"2200f473-517b-387c-82ff-bd3866c0ebc4","product":{"name":"obsidian-tc","vendor":{"name":"The-40-Thieves"}},"product_version":"\u003c 1.3.1"}],"enisaIdVendor":[{"id":"964bff75-6295-3bfc-a666-974c8bf4e925","vendor":{"name":"The-40-Thieves"}}],"enisaIdVulnerability":[{"id":"83dfc708-de97-310e-a68e-c4a01e11362e","vulnerability":{"id":"CVE-2026-77362","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller\u0027s read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.","datePublished":"Oct 13, 2026, 2:00:11 PM","dateUpdated":"Oct 13, 2026, 2:50:19 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/75\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-98689\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 28, 2026, 7:15:15 AM","vulnerabilityProduct":[{"id":"b1f005d6-879d-3289-b192-db55c973d1a5","product":{"name":"obsidian-tc","vendor":{"name":"The-40-Thieves"}},"product_version":"\u003c 1.3.1"}],"vulnerabilityVendor":[{"id":"ec7431c4-8e95-31f5-8d73-11343e2e485d","vendor":{"name":"The-40-Thieves"}}]}},{"id":"fc165a39-aac8-3e07-a4c3-f1a0b06f955c","vulnerability":{"id":"GHSA-43r2-c7g8-prc8","description":"obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields","datePublished":"Oct 23, 2026, 6:28:14 PM","dateUpdated":"Oct 23, 2026, 6:28:14 PM","baseScore":0.0,"references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77362\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/75\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309\nhttps://github.com/The-40-Thieves/obsidian-tc\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-98689\n","aliases":"CVE-2026-77362\nGHSA-43r2-c7g8-prc8\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 7:03:20 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}