CVE-2026-77362

Prior to version 1.3.1 , the obsidian-tc Model Context Protocol server for Obsidian vaults fails to consistently apply the read access-control list (ACL) to all returned fields. Specifically, the tasks_filter tool exposes group counts from denied notes, makemd_query passes unfiltered sibling resu...