CVE-2026-54203

EUVD-2026-54435
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds
 with memory. By repeatedly 
requesting this endpoint, an attacker can access sensitive 
information, including user passwords. Exploitation does not require 
authentication. This issue affects TeamDavid through Rollout 524.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.46%
Common Weakness Enumeration
References
https://david.tobit.software/releasenotes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/