CVE-2026-77362: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.
References
- github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309
- github.com/The-40-Thieves/obsidian-tc/pull/75
- github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-43r2-c7g8-prc8
- github.com/advisories/GHSA-43r2-c7g8-prc8
- nvd.nist.gov/vuln/detail/CVE-2026-77362
Code Behaviors & Features
Detect and mitigate CVE-2026-77362 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →