obsidian-tc, a server for managing Obsidian vaults, had a flaw from version 1.13.0 through 1.31.4 that allowed a client to perform destructive requests after a user declined or omitted a required confirmation. The system mistrusted a previously minted requestState as evidence of approval, even when the confirmation step had been bypassed. As a result, harmful actions such as note overwrites or moves could be executed without the human’s consent, though the caller still needed normal tool permissions. This weakness is classified as an authorization error and a missing authorization check in the handling of destructive tools.

The-40-Thieves obsidian-tc deployments that use a streamable HTTP interface auth.jwtSecret enabled and a compatible client that supports elicitation.forms, specifically versions from 1.13.0 up to 1.31.4, are impacted. Deployments that use stdio or leave the JWT secret unset are not affected.

The CVSS score of 7.1 indicates a high severity. The exploit requires network access to the HTTP API and a client capable of forging requestState, so the attack vector is likely remote over the network. The probability of exploitation is unclear due to lack of EPSS data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread use. However, the flaw allows an attacker with access to the API to perform destructive operations without legitimate approval, leading to data corruption or loss.