CVE-2026-12071

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS

No CVSS.

References

Link	Resource
https://chayns.net/77892-10814/tapp/763210?postId=11454
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El Webbox de TeamDavid de Tobit Laboratories AG construye URLs de redirección utilizando entrada proporcionada por el usuario, que se añade al objetivo de redirección en una respuesta HTTP 302. Al utilizar caracteres codificados en URL como ’%2e’ (que representa un punto), un atacante puede manipular la porción de la URL que sigue al dominio de nivel superior (TLD). Si existe un TLD similar y registrable (por ejemplo, si ’.com’ es el dominio de la aplicación y ’.company’ está disponible para registro), un atacante puede elaborar una URL para redirigir a los usuarios a un dominio ’.company’ malicioso. Al utilizar saltos de línea codificados en URL, se hace posible insertar encabezados de respuesta arbitrarios en la respuesta HTTP del servidor. Este problema afecta a TeamDavid hasta el Rollout 524.

Information

Published : 2026-08-07 10:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-12071

Mitre link : CVE-2026-12071

CVE.ORG link : CVE-2026-12071

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-12071", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12071", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T11:19:50.374307Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-07T10:16:56.297", "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "source": "vulnerability@ncsc.ch"}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "The Webbox of TeamDavid by\u00a0Tobit Laboratories AG\u00a0constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.\n\n\n\n\n\n\nThis issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}, {"lang": "es", "value": "El Webbox de TeamDavid de Tobit Laboratories AG construye URLs de redirecci\u00f3n utilizando entrada proporcionada por el usuario, que se a\u00f1ade al objetivo de redirecci\u00f3n en una respuesta HTTP 302. Al utilizar caracteres codificados en URL como \u2019%2e\u2019 (que representa un punto), un atacante puede manipular la porci\u00f3n de la URL que sigue al dominio de nivel superior (TLD). Si existe un TLD similar y registrable (por ejemplo, si \u2019.com\u2019 es el dominio de la aplicaci\u00f3n y \u2019.company\u2019 est\u00e1 disponible para registro), un atacante puede elaborar una URL para redirigir a los usuarios a un dominio \u2019.company\u2019 malicioso. Al utilizar saltos de l\u00ednea codificados en URL, se hace posible insertar encabezados de respuesta arbitrarios en la respuesta HTTP del servidor.\n\nEste problema afecta a TeamDavid hasta el Rollout 524."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "vulnerability@ncsc.ch"}