External risk intelligence

Tobit TeamDavid Webbox Memory Leak Exposes Sensitive Information

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-54203

The vulnerability resides in the Webbox component of the product, which is designed to handle web traffic and external requests. The vulnerable endpoint is a public-facing URL path reachable without authentication, making it accessible to any user or entity on the internet by design.

Information Disclosure

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows unauthorized actors to access sensitive information, including user passwords, by repeatedly requesting a specific URL without any authentication. This memory leak issue could potentially expose confidential data if the affected component is in use.

Sensitive information can be exposed by anyone.
Unauthenticated access to passwords is a serious risk.
Confirm if this product is used and if the specific function is enabled.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by repeatedly accessing a specific URL on the Webbox, which responds by leaking memory. This allows the attacker to gather sensitive information, including user passwords, without needing any prior authentication.

Publicly accessible URL requires no authentication.
Repeatedly accessing the URL triggers memory leaks.
Sensitive information, including passwords, can be read.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated actor to repeatedly access a specific URL, causing the application to disclose memory contents. This memory could contain sensitive information, such as user passwords, when the supported conditions for exposure are met.

User passwords could be exposed.
An unauthenticated actor repeatedly requests a URL.
Sensitive information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Tobit Laboratories AG TeamDavid Webbox component is likely managed by the application owner and the infrastructure or platform team responsible for its deployment. The first practical move is to identify all instances of this Webbox, determine their exposure to the internet, confirm business criticality, and then locate the accountable owner before planning remediation, coordinating with the vendor as needed.

Application and Infrastructure teams own the issue.
Verify external reachability and business impact.
Plan coordinated vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tobit TeamDavid and what does its Webbox component do?

Tobit TeamDavid is a collaborative software suite often used as an alternative to Microsoft 365 for managing email, calendars, and messaging. The Webbox component acts as the interface that handles web-based traffic, allowing the server to communicate with external browsers and services to facilitate these communication features.

How does this CVE-2026-54203 memory leak work?

This vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It occurs because the Webbox software fails to properly manage memory when responding to requests at a specific endpoint. Instead of returning a standard error or expected data, it inadvertently includes contents from the system's memory in its response, which can contain private data like passwords.

Do I need special access to trigger this TeamDavid bug?

No, you do not need any credentials or special privileges to trigger this vulnerability. The flaw is reachable by sending repeated, unauthenticated requests to the specific URL path '/.well-known/mta-sts.'. If the service is running, it will process these requests and return memory contents to anyone who asks, meaning an attacker does not need to be logged into the system.

Is my system at risk if it runs TeamDavid?

According to Halo Surface Signal, this vulnerability is very likely to pose a risk because the vulnerable Webbox component is explicitly designed to handle internet-facing traffic. Since the affected endpoint is accessible without authentication, any device or server running this version of TeamDavid that is reachable from the internet is directly exposed to potential information disclosure.

When should I take action for CVE-2026-54203?

You should prioritize identifying all deployments of TeamDavid in your environment immediately. Since this involves potential password exposure, verify whether your Webbox instances are internet-facing. Once you have an inventory, work with your infrastructure team to assess the impact and coordinate with Tobit Laboratories AG to obtain the necessary updates or guidance to secure the affected component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.