{"id":"CVE-2026-54201","state":"PUBLISHED","title":"TeamDavid: Missing Authorization","description":"Tobit Laboratories AG TeamDavid's Webbox  does not enforce authentication or authorization checks\n when serving these log files. As a result, attackers can obtain \nsensitive error information or internal application details, potentially\n aiding in further attacks. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","publishedAt":"2026-08-07T09:43:18.647Z","updatedAt":"2026-09-07T12:45:29.829Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","source":"NCSC.ch"},"assigner":"NCSC.ch","products":["Tobit Laboratories AG TeamDavid"],"affected":[{"vendor":"Tobit Laboratories AG","product":"TeamDavid","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"Rollout 528","versionType":"custom"}],"modules":["Webbox"]}],"references":["https://chayns.net/77892-10814/tapp/763210?postId=11454","https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/54xxx/CVE-2026-54201.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-54201","state":"PUBLISHED","datePublished":"2026-08-07T09:43:18.647Z","dateUpdated":"2026-09-07T12:45:29.829Z","assignerShortName":"NCSC.ch","assignerOrgId":"455daabc-a392-441d-aa46-37d35189897c","dateReserved":"2026-06-12T09:32:44.531Z"},"containers":{"cna":{"title":"TeamDavid: Missing Authorization","descriptions":[{"lang":"en","value":"Tobit Laboratories AG TeamDavid's Webbox  does not enforce authentication or authorization checks\n when serving these log files. As a result, attackers can obtain \nsensitive error information or internal application details, potentially\n aiding in further attacks. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}],"affected":[{"vendor":"Tobit Laboratories AG","product":"TeamDavid","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"Rollout 528","versionType":"custom"}],"modules":["Webbox"]}],"references":[{"url":"https://chayns.net/77892-10814/tapp/763210?postId=11454","tags":["release-notes"]},{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"NCSC.ch","orgId":"455daabc-a392-441d-aa46-37d35189897c","dateUpdated":"2026-09-07T12:45:29.829Z"},"credits":[{"lang":"en","value":"Dario Weiss of InfoGuard Labs","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T11:30:50.391724Z","id":"CVE-2026-54201","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T11:33:56.141Z"}}]}}}