Which versions of TeamDavid are affected by CVE-2026-54213?

Tobit TeamDavid groupware server (Rollout 524 and earlier) contains an unauthenticated denial-of-service vulnerability allowing any remote attacker to permanently shut down the server with a single…

How to fix or mitigate CVE-2026-54213?

Within 24 hours: Identify all instances of Tobit TeamDavid in your environment and confirm versions through Rollout 524; immediately implement network-level access controls (firewall, WAF, or reverse proxy rules) to block unauthorized access to the /internalRestart endpoint and verify effectiveness. Within 7 days: Contact Tobit Laboratories AG to request patch status and estimated timeline; review and strengthen access controls to restrict /internalRestart endpoint access to authorized administrators only via VPN or trusted networks. Within 30 days: Establish continuous monitoring and alerting for requests to the /internalRestart endpoint to detect exploitation attempts; remain in contact with vendor regarding patch availability and deploy immediately upon release.

TeamDavid CVE-2026-54213

Q: What is the CVSS score of CVE-2026-54213?

CVE-2026-54213 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-54444 CRITICAL

Improper Access Control (CWE-284)

2026-08-07 NCSC.ch

GHSA-wrxj-2wgm-px6x

Authentication Bypass Denial Of Service Teamdavid Tobit Laboratories Ag

9.2

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Single unauthenticated HTTP request over the network with no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H), with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 10:36 vuln.today

CVE Published

Aug 07, 2026 - 09:47 cve.org

CRITICAL 9.2

DescriptionCVE.org

Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524.

AnalysisAI

Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenticated attacker to shut down the server by requesting the exposed /internalRestart endpoint, which fully halts the service rather than restarting it. All releases through Rollout 524 are affected, and recovery requires manual administrator intervention to bring the server back online. No public exploit identified at time of analysis, though the trigger is trivial (a single HTTP request to a known path).

Technical ContextAI

TeamDavid is Tobit Laboratories' 'David' messaging and groupware platform, marketed as a self-hosted Microsoft 365 alternative; the affected component is its web-facing Webbox HTTP interface (CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*). The root cause is classed as CWE-284 (Improper Access Control): an administrative/internal maintenance function - /internalRestart - is reachable without any authentication or authorization check from the public Internet. Compounding the access-control flaw, the endpoint's implementation does not perform the intended restart cycle; instead it terminates the server process outright, converting an intended benign operation into a hard shutdown with no automatic recovery.

RemediationAI

Upgrade TeamDavid to a Rollout newer than 524 as provided by Tobit; check the vendor release notes at https://david.tobit.software/releasenotes for the exact patched Rollout, since a specific fixed version is not confirmed in the available data (Patch available per vendor advisory, released patched version not independently confirmed). As an immediate compensating control, block or restrict external access to the /internalRestart endpoint at a reverse proxy, WAF, or firewall so it is unreachable from the Internet - this is low-risk since the endpoint should never be exposed publicly. Where feasible, place the Webbox web interface behind a VPN or IP allowlist and monitor web logs for requests to /internalRestart as an early indicator; the trade-off of proxy filtering is negligible, while full network restriction may impede legitimate remote administration and should be validated against operational needs. Consult the InfoGuard Labs write-up (https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/) for additional context on related David issues.