CVE-2026-77366

Name of the Vulnerable Software and Affected Versions obsidian-tc versions prior to 1.3.1

Description Tool dispatch fails to compare the caller-controlled input.vault value with the vault bound to the caller. Additionally, the JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—lacks a vault claim, and the folder access-control list is shared globally. This allows any user with a valid token to select another configured vault and perform read, write, or delete operations on its contents through affected tools.

Recommendations Update obsidian-tc to version 1.3.1.