CVE-2026-77366

{
  "etk_id": "ETK-2026-1397",
  "cve_id": "CVE-2026-77366",
  "display_id": "CVE-2026-77366",
  "ghsa_id": "GHSA-84c9-qqpq-2pq5",
  "euvd_id": "EUVD-2026-97737",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-vault authorization bypass in obsidian-tc",
  "summary": "obsidian-tc versions before 1.3.1 do not properly bind authenticated requests to the caller’s assigned vault. An attacker with any valid token may access content in other configured vaults, including reading, changing, or deleting it, when those vaults are available to the server.",
  "mitigation": "Upgrade obsidian-tc to version 1.3.1 or later. Restrict access to valid tokens and limit exposure of configured vaults until the upgrade is complete.",
  "vendor": "The-40-Thieves",
  "product": "obsidian-tc",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.3.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.3.1"
      ],
      "package_name": "obsidian-tc",
      "purl": "pkg:npm/obsidian-tc"
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2223,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.046169466666665,
  "t0_at": "2026-10-12T17:54:31.642000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T17:54:31.642000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T17:54:31.642000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77366"
    }
  }
}