TeamDavid Webbox CVE-2026-54215

The 'replyUrl' parameter in TeamDavid's Webbox component is reachable without authentication (PR:N in the CVSS 4.0 vector), meaning no login or session token is required to craft the malicious URL. No special server configuration, non-default feature, or privileged deployment mode is indicated as a prerequisite - the vulnerability appears present in standard Webbox deployments through Rollout 524. Exploitation is strictly bounded by the requirement for passive user interaction: a victim must click or navigate to the crafted link (UI:P); the attacker cannot force a redirect server-side without user agency. The flaw does not enable direct server-side code execution, authentication bypass, or data exfiltration from TeamDavid systems - impact is confined to steering the victim's browser to an attacker-chosen external destination.

The CVSS 4.0 score of 5.3 (Medium) accurately captures the constrained direct impact: the flaw enables phishing enablement rather than server-side code execution or data exfiltration. The vector AV:N/AC:L/AT:N/PR:N/UI:P confirms the attack is network-reachable with no authentication requirement and no special preconditions, but passive user interaction - a victim must visit the crafted URL - is mandatory, which materially limits automated or mass exploitation. No CISA KEV listing and no EPSS data were provided, so exploitation probability cannot be quantified numerically; active exploitation is neither confirmed nor refuted. The InfoGuard batch disclosure of 22 CVEs suggests coordinated responsible disclosure rather than observed in-the-wild abuse. The meaningful risk is reputational and social-engineering: organizations whose users rely on the TeamDavid domain as a trusted communication hub face elevated phishing exposure. The vulnerability is low-sophistication to exploit manually but cannot be automated without user interaction, keeping real-world blast radius moderate.

An attacker constructs a URL such as https://teamdavid-tenant.example.com/webbox?replyUrl=https://attacker-phishing.com/harvest and distributes it via email or internal messaging, exploiting the trusted reputation of the organization's TeamDavid domain to reduce user suspicion. A recipient clicks the link, the Webbox component performs an unvalidated redirect, and the victim's browser lands on the attacker-controlled phishing page for credential harvesting or malware delivery. No public exploit code has been identified at time of analysis, but the attack is trivially reproducible given that the vulnerable parameter name is explicitly disclosed in the CVE description.