Vulnerability · Published Aug 7, 2026 · Assigned by NCSC.ch

CVE-2026-54203TeamDavid: Memory Leak leaking sensitive information

Critical 9.2

In plain English

A critical-severity information exposure in TeamDavid from Tobit Laboratories AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.6%top 53.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Affected products (as reported)

Vendor	Product	Versions
Tobit Laboratories AG	TeamDavid	0 – before Rollout 528

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

https://chayns.net/77892-10814/tapp/763210?postId=11454 release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ third-party-advisory