Skip to main content

TeamDavid Webbox CVE-2026-54201

| EUVDEUVD-2026-54433 MEDIUM
Missing Authorization (CWE-862)
2026-08-07 NCSC.ch GHSA-r8f9-gq2j-8hf4
Authentication Bypass Teamdavid
6.9
CVSS 4.0 · Vendor: NCSC.ch
Share

Severity by source

Vendor (NCSC.ch) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Unauthenticated network access to log files yields only low confidentiality impact; no integrity or availability impact; no scope change to subsequent systems warranted in 3.1 framing.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 07, 2026 - 10:45 vuln.today

DescriptionCVE.org

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through Rollout 524.

AnalysisAI

Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to retrieve sensitive error messages and internal application details without any credentials. All TeamDavid versions through Rollout 524 are affected per CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The TeamDavid Webbox interface must be network-reachable by the attacker - either internet-exposed or accessible from within the attacker's network segment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity, network-accessible exploitation with no preconditions - the worst-case access profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade TeamDavid to a rollout version beyond Rollout 524 by consulting the vendor release notes at https://david.tobit.software/releasenotes to identify the exact patched release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Teamdavid

View all
CVE-2026-54212 CRITICAL
9.5 Aug 07

Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
CVE-2026-54210 CRITICAL
9.5 Aug 07

Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration

CVE-2026-54211 CRITICAL
9.5 Aug 07

Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
CVE-2026-54213 CRITICAL
9.2 Aug 07

Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
CVE-2026-54203 CRITICAL
9.2 Aug 07

Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
CVE-2026-54209 HIGH
8.9 Aug 07

Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
CVE-2026-54218 HIGH
8.8 Aug 07

Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
CVE-2026-54208 HIGH
8.5 Aug 07

Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
CVE-2026-54202 HIGH
8.5 Aug 07

Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
CVE-2026-54200 HIGH
8.4 Aug 07

File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to

CVE-2026-12070 HIGH
8.4 Aug 07

Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file

CVE-2026-54204 HIGH
7.7 Aug 07

Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-54201 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy