CVE-2026-115477: CWE-285: Improper Authorization in The-40-Thieves obsidian-tc

The vulnerability in obsidian-tc (versions >=1.13.0 <1.31.4) arises from improper authorization related to the elicitation form approval process in a Streamable HTTP deployment with auth.jwtSecret configured. A client that supports elicitation.form can resubmit a call with a valid requestState minted before the elicitation leg was requested, causing the server to trust this state as approval even if the human declined or omitted the response. This allows execution of dispatch-gated destructive vault operations without human approval, although the client still requires ordinary tool permissions. The vulnerability does not affect stdio deployments or those without auth.jwtSecret set. The issue is resolved in version 1.31.4.

An attacker or a misbehaving client can bypass the human-in-the-loop approval process for destructive vault operations, potentially leading to unauthorized destructive changes such as overwriting or moving notes. The attacker must have the necessary tool permissions but can execute these operations without explicit human consent, increasing the risk of unauthorized data modification or loss.

Upgrade obsidian-tc to version 1.31.4 or later, where this improper authorization vulnerability is fixed. Deployments using stdio or without auth.jwtSecret configured are not affected by this issue. No other mitigations are indicated, and the fix does not prevent a malicious client from fabricating approval, but it ensures the server no longer trusts stale requestState values as proof of human approval.