Authorization Bypass

obsidian-tc is vulnerable to authorization bypass. The vulnerability is due to insufficient validation of the caller-controlled vault identifier, missing vault binding in JWTs, and globally shared folder access controls, which allows an attacker with a valid token to read, modify, or delete...