CVE-2026-77362: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in The-40-Thieves obsidian-tc

The vulnerability CVE-2026-77362 in obsidian-tc occurs because bridge tools prior to version 1.3.1 fail to consistently apply read ACLs to all returned fields. Specifically, the tasks_filter tool exposes group counts derived from notes that should be denied, makemd_query returns unfiltered sibling result fields, and list_templates reveals template paths and parsed user-function bodies without a read-whitelist check. This allows an authenticated caller to infer or directly read data from notes outside their read ACL. The issue is fixed in version 1.3.1 by applying filtering and enforcing read whitelists on the affected fields.

An authenticated user can access or infer sensitive information from notes that they are not authorized to read due to incomplete enforcement of read ACLs. The confidentiality of note data is impacted, but integrity and availability are not affected. The CVSS score is 4.3 (medium), reflecting limited impact confined to information disclosure without privilege escalation or denial of service.

Upgrade obsidian-tc to version 1.3.1 or later, where the vulnerability is fixed by proper filtering of path-attributable fields and enforcement of read whitelists. No other mitigation is required as the fix is official and addresses the issue directly.