{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12071", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2026-06-12T09:32:52.061Z", "datePublished": "2026-08-07T09:40:52.596Z", "dateUpdated": "2026-09-07T12:40:34.507Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-09-07T12:40:34.507Z"}, "title": "TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 URL redirection to untrusted site ('open redirect')", "type": "CWE"}]}], "affected": [{"vendor": "Tobit Laboratories AG", "product": "TeamDavid", "modules": ["Webbox"], "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Webbox of TeamDavid by\u00a0Tobit Laboratories AG\u00a0constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.\n\n\n\n\n\n\nThis issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The Webbox of TeamDavid by&nbsp;Tobit Laboratories AG&nbsp;constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.</div><p><br></p><div><div><span>This issue affects TeamDavid before Rollout 528.</span></div><div><span>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</span></div><br></div><p><br></p>"}]}], "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "tags": ["release-notes"]}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Dario Weiss of InfoGuard Labs", "type": "finder"}, {"lang": "en", "value": "Olivier Becker of InfoGuard Labs", "type": "finder"}, {"lang": "en", "value": "Lucas Dodgson of InfoGuard Labs", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T11:19:50.374307Z", "id": "CVE-2026-12071", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T11:21:46.019Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12071", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T11:19:50.374307Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T11:21:41.341Z"}}], "cna": {"title": "TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dario Weiss of InfoGuard Labs"}, {"lang": "en", "type": "finder", "value": "Olivier Becker of InfoGuard Labs"}, {"lang": "en", "type": "finder", "value": "Lucas Dodgson of InfoGuard Labs"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "tags": ["release-notes"]}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The Webbox of TeamDavid by\u00a0Tobit Laboratories AG\u00a0constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.\n\n\n\n\n\n\nThis issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.", "supportingMedia": [{"type": "text/html", "value": "<div>The Webbox of TeamDavid by&nbsp;Tobit Laboratories AG&nbsp;constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.</div><p><br></p><div><div><span>This issue affects TeamDavid before Rollout 528.</span></div><div><span>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</span></div><br></div><p><br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL redirection to untrusted site ('open redirect')"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-09-07T12:40:34.507Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12071", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:40:34.507Z", "dateReserved": "2026-06-12T09:32:52.061Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-08-07T09:40:52.596Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Webbox"], "product": "TeamDavid", "vendor": "Tobit Laboratories AG", "versions": [{"lessThan": "Rollout 528", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "vulnerability@ncsc.ch"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Webbox of TeamDavid by\u00a0Tobit Laboratories AG\u00a0constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server's HTTP \nresponse.\n\n\n\n\n\n\nThis issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}], "id": "CVE-2026-12071", "lastModified": "2026-09-07T13:18:02.290", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12071", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T11:19:50.374307Z", "version": "2.0.3"}}]}, "published": "2026-08-07T10:16:56.297", "references": [{"source": "vulnerability@ncsc.ch", "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454"}, {"source": "vulnerability@ncsc.ch", "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}