CVE-2026-54214

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS

No CVSS.

References

Link	Resource
https://chayns.net/77892-10814/tapp/763210?postId=11454
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La aplicación Webbox de TeamDavid de Tobit Laboratories AG es vulnerable a la inyección de encabezados HTTP a través del parámetro URL ’cType’, lo que permite la modificación arbitraria del encabezado Content-Type en las respuestas HTTP. Debido a que el parámetro no restringe adecuadamente los caracteres de control como los saltos de línea codificados en URL (’%0a’) o los dos puntos, los atacantes pueden inyectar encabezados adicionales, incluyendo encabezados Location extra, en la respuesta del servidor. Esto resulta, por ejemplo, en una vulnerabilidad de redirección abierta. Este problema afecta a TeamDavid hasta el Rollout 524.

Information

Published : 2026-08-07 10:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-54214

Mitre link : CVE-2026-54214

CVE.ORG link : CVE-2026-54214

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-54214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54214", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T11:25:40.877413Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-07T10:16:58.637", "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "source": "vulnerability@ncsc.ch"}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "source": "vulnerability@ncsc.ch"}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the \n\u201ccType\u201d URL parameter, which allows arbitrary modification of the \nContent-Type header in HTTP responses. Because the parameter does not \nproperly restrict control characters such as URL-encoded newlines \n(\u201c%0a\u201d) or colons, attackers can inject additional headers including \nextra Location headers into the server\u2019s response. This results e.g. in \nan open redirect vulnerability.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}, {"lang": "es", "value": "La aplicaci\u00f3n Webbox de TeamDavid de Tobit Laboratories AG es vulnerable a la inyecci\u00f3n de encabezados HTTP a trav\u00e9s del par\u00e1metro URL \u2019cType\u2019, lo que permite la modificaci\u00f3n arbitraria del encabezado Content-Type en las respuestas HTTP. Debido a que el par\u00e1metro no restringe adecuadamente los caracteres de control como los saltos de l\u00ednea codificados en URL (\u2019%0a\u2019) o los dos puntos, los atacantes pueden inyectar encabezados adicionales, incluyendo encabezados Location extra, en la respuesta del servidor. Esto resulta, por ejemplo, en una vulnerabilidad de redirecci\u00f3n abierta. Este problema afecta a TeamDavid hasta el Rollout 524."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "vulnerability@ncsc.ch"}