{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.3.1"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3956ed5173ebde7864c7d576c259e9e747b11d76"
            }
          ],
          "repo": "https://github.com/the-40-thieves/obsidian-tc",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-c5xx-h28h-f682"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-59",
      "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77361.json"
  },
  "details": "obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path.",
  "id": "CVE-2026-77361",
  "modified": "2026-10-14T02:31:01.484365622Z",
  "published": "2026-10-13T14:00:39.982Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77361.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/The-40-Thieves/obsidian-tc/commit/c81d1687e2cfec98a0d8bc5038c029f41ea9c920"
    },
    {
      "type": "FIX",
      "url": "https://github.com/The-40-Thieves/obsidian-tc/pull/76"
    },
    {
      "type": "WEB",
      "url": "https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-c5xx-h28h-f682"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77361"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "obsidian-tc symlink path mismatch bypasses read ACL restrictions"
}