CVE-2026-115478: Incorrect Authorization and Incomplete Cleanup in obsidian-tc

Vulnerability ID: CVE-2026-115478
CVSS Score: 7.1
Published: 2026-10-23

In obsidian-tc versions 1.0.1 through 1.31.3, memory lifecycle tools fail to validate note ownership prior to rematerializing Markdown files and execute non-atomic SQLite database mutations. An authorized caller can overwrite arbitrary note bodies on disk and cause persistent desynchronization between the database memory graph and physical vault files.

TL;DR

obsidian-tc memory tools fail to verify note ownership before materializing files and perform non-atomic database state changes, resulting in potential note body destruction and memory graph desynchronization.

Technical Details

• CWE ID: CWE-459, CWE-863
• CVSS v4.0 Score: 7.1 (HIGH)
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
• Attack Vector: Network
• Privileges Required: Low (PR:L)
• Exploit Status: None (No public exploit available)
• CISA KEV Status: Not Listed

Affected Systems

• obsidian-tc (Obsidian Turbocharged) server versions >= 1.0.1, < 1.31.4

Mitigation Strategies

• Upgrade obsidian-tc to version 1.31.4 or higher
• Enable automated note snapshots in configuration files to enable point-in-time recovery
• Apply strict writePaths ACL restrictions to confine memory operations to designated folders

Remediation Steps:

1. Update obsidian-tc via npm: npm install -g obsidian-tc@latest
2. If using Docker, pull the patched container image: docker pull ghcr.io/the-40-thieves/obsidian-tc:1.31.4
3. Verify that memory entity files contain obsidian_tc_id in their YAML frontmatter
4. Inspect server logs for note_exists or invalid_input error codes during memory lifecycle calls

References

• NVD - CVE-2026-115478
• CVE.org - CVE-2026-115478
• GitHub Security Advisory GHSA-r3g7-r4hr-m258
• Pull Request #978: Memory Lifecycle Fixes
• Fix Commit 99f7914ca0fbeed92e7c4d39cc8c3e5830dab133
• Release v1.31.4
• obsidian-tc Changelog

Read the full report for CVE-2026-115478 on our website for more details including interactive diagrams and full exploit analysis.