{"id":"ghsa-ghsa-84c9-qqpq-2pq5","seq":544322,"kind":"advisory","title":"obsidian-tc tokens can access arbitrary configured vaults","url":"https://github.com/advisories/GHSA-84c9-qqpq-2pq5","permalink":"https://vulnpulse.app/items/ghsa-ghsa-84c9-qqpq-2pq5","summary":"影響: npm:obsidian-tc < 1.3.1 → 1.3.1\nTool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites. (resources/read was the only surface that already guarded this.) Patches Fixed in 1.3.1 (the fix was developed on the v1.3.0 tag, which never published…","severity":"critical","techs":["nodejs"],"cves":["CVE-2026-77366"],"tags":["GHSA-84c9-qqpq-2pq5","obsidian-tc"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T17:29:17.000Z","fetched_at":"2026-10-23T18:42:53.259Z"}