Vulnerability · Published Aug 7, 2026 · Assigned by NCSC.ch

CVE-2026-54199TeamDavid: Header Injection through request body in link storing functionality

Medium 5.3

In plain English

A medium-severity improper input validation in TeamDavid from Tobit Laboratories AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 61.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClient_celink.htm), which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to the redirect link, resulting in the ability to control the response headers. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Affected products (as reported)

Vendor	Product	Versions
Tobit Laboratories AG	TeamDavid	0 – before Rollout 528

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://chayns.net/77892-10814/tapp/763210?postId=11454 release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ third-party-advisory