CVE-2026-77366: Cross-Vault Authorization Bypass in obsidian-tc Exposes All Configured Vaults
What the Vulnerability Is
CVE-2026-77366 is an IDOR / broken object-level authorization flaw (CWE-639, CWE-863) in the npm package obsidian-tc. The server's authorization layer checks only that a presented token is valid — it never verifies that the token is scoped to the specific vault being requested. As a result, a token issued for one Obsidian vault can be reused to read or write any other vault hosted on the same obsidian-tc server. This is a complete tenant-isolation failure for any multi-vault deployment: a single authenticated client can escalate from access to its own vault to full read/write access across every vault on the server, with a CVSS score of 9.9 reflecting the severity of that blast radius.
Affected Software
- Vendor/Package: npm package
obsidian-tc - Affected versions: prior to 1.3.1
- Fix: upgrade to
obsidian-tc >= 1.3.1
Exploitation Status
A public proof-of-concept exists for this vulnerability (poc-public), disclosed 2026-10-23. There is no confirmed KEV listing or evidence of in-the-wild weaponization at this time, but the combination of a public exploitation path, trivial exploitation mechanics (token reuse against an alternate vault identifier), and a near-maximum CVSS score means defenders should treat this as high priority for both patching and detection, particularly for any obsidian-tc deployment hosting multiple vaults for different users or teams.
How Our Detection Catches It
The detection logic centers on identifying a single token or session identity that accesses vault identifiers outside the scope it was originally provisioned for. In practice this means correlating authentication/session context with the vault path or vault ID referenced in each request, and flagging cases where one token touches multiple distinct vaults — especially in rapid succession, which is consistent with enumeration behavior during exploitation. We ship this logic across seven SIEM platforms so defenders can deploy it regardless of stack: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). Each rule is tuned to the respective platform's log shape for obsidian-tc access events while preserving the same core signal: token-to-vault mismatch and cross-vault access velocity.
Remediate and Review
The immediate fix is to upgrade affected obsidian-tc deployments to version 1.3.1 or later, which enforces per-token vault scoping. Until patched, the detection rules above provide a compensating control to catch active exploitation attempts. Full detection logic, investigation guidance, and atomic tests are available on the detection page: https://df00tech.com/detections/CVE-2026-77366.