Tobit Laboratories AG TeamDavid

22 CVEs in Tobit TeamDavid, a DACH-region self-hosted Microsoft 365 alternative: an unauthenticated heap leak hands over stored mailbox passwords, and Rollout 528 disables the affected function

InfoGuard Labs published 22 CVEs on 2026-08-07 against the Webbox web application of Tobit TeamDavid, an enterprise collaboration and unified-messaging suite sold across the DACH region as a self-hosted alternative to Microsoft 365 and combining mail, video conferencing and chat with fax, SMS and physical letter mail; the researchers found the flaws during an external penetration test and put current Shodan and Censys data at approximately 12,000 publicly accessible instances (InfoGuard Labs, 2026-08-07). Their own summary of the impact is that successful exploitation primarily leads to complete compromise of user mail accounts, with the potential for full system compromise (InfoGuard Labs, 2026-08-07).

The chain that needs no credentials is two flaws deep. The application is largely file-based, and access to each user's mailbox is governed by an access.ini file in that user's directory holding the username and a stored password that is obfuscated rather than encrypted, each character XORed against a key derived from 128 plus its index position, which anyone holding the file can reverse, and in some instances the password is stored in plaintext outright without the researchers being able to pin down what triggers that (CVE-2026-54218) (InfoGuard Labs, 2026-08-07). Reaching those files remotely is what the second flaw provides. The unauthenticated /.well-known/mta-sts. handler treats the part of the URL after mta-sts. as a file extension and reads the corresponding file from a fixed directory; when that file does not exist it skips the read but continues processing a buffer it allocated and never zeroed, then returns the leftover heap contents as an HTTP 200 body, up to 4 KB of residual memory from earlier requests, which in the researchers' testing spilled access.ini contents, email, attachments, configuration files and SQL queries (CVE-2026-54203) (InfoGuard Labs, 2026-08-07). Poll the endpoint, recover an access.ini, decode the password, log in as that user.

Separately, an endpoint named /internalRestart does not restart anything; one unauthenticated request shuts the web server down entirely and it stays offline until an administrator brings it back by hand (CVE-2026-54213) (InfoGuard Labs, 2026-08-07). Four further buffer overflows crash the server, three of them needing no credentials at all: an overlong filename in the file-upload functions (CVE-2026-54210), a request body beginning with a number followed by at least seven characters on an API endpoint (CVE-2026-54212), and the password-change handler, which is triggered by putting the string (editini) in the request path and loads the file at that path into a fixed-size stack buffer without checking that it is actually an Archive.ini, so an unauthenticated caller can point it at any oversized file (CVE-2026-54209); the fourth, in several form parameters of the serverClient_close.html endpoint, requires an authenticated session (CVE-2026-54211) (InfoGuard Labs, 2026-08-07). The researchers observed these terminate the process with STATUS_STACK_BUFFER_OVERRUN and note that the stack cookie blocks a straightforward return-address overwrite, while stating that with a different stack state or a canary leaked through another flaw these could potentially escalate to remote code execution (InfoGuard Labs, 2026-08-07), that escalation is explicitly hypothetical and has not been demonstrated.

The remaining flaws matter mostly for what they do to the surrounding domain. Four separate functions resolve attacker-supplied UNC paths, so the server can be made to authenticate outbound to an attacker-controlled host and hand over NetNTLM material for capture or relay whenever 445/TCP egress is permitted: the search function's pathnameroot parameter takes it without authentication, though a ../ in the URL is needed to get past the authorisation check (CVE-2026-54204), while the link-storing, @@INCLUDE messaging and archive-move paths require an authenticated session (CVE-2026-54205, CVE-2026-54206, CVE-2026-54207) (InfoGuard Labs, 2026-08-07). An authenticated user can attach arbitrary server files to an outgoing message with @@attach and download them, bypassing the filter over configuration and user directories through NTFS alternate data streams, which reaches the server's private key and other users' access.ini files (CVE-2026-54200); delete any file on the server with @@COMMENTFILE (CVE-2026-12070); and create folders anywhere on disk, including system directories and other users' private directories, through the archive-creation path (CVE-2026-54202) (InfoGuard Labs, 2026-08-07). An unauthenticated arbitrary file write in the password-change function, constrained by the target directory's own access.ini, still allows planting a .htm file that executes JavaScript when opened (CVE-2026-54208), and error logs are served with no authentication or authorisation check at a predictable URL (CVE-2026-54201) (InfoGuard Labs, 2026-08-07). A reflected and a stored cross-site scripting flaw, two open redirects and two HTTP header injections round out the set (InfoGuard Labs, 2026-08-07).

The disclosure history is the reason this is an exposure decision rather than a patching one. The researchers first contacted the vendor on 2025-11-05, submitted 13 findings on 2025-12-27, were told on 2026-01-27 that eight were patched with five scheduled for the next release, retested on 2026-02-06 and found several only partially remediated plus nine new issues, escalated to a national cyber security centre on 2026-02-17, sent CVE drafts on 2026-05-28, and by 2026-08-06 recorded that no further response had been received from the manufacturer despite multiple follow-up emails, publishing the next day (InfoGuard Labs, 2026-08-07). The CVE records as published bound every one of the 22 issues at TeamDavid through Rollout 524. After publication the vendor told the researchers that Rollout 528, released on 30 June 2026, disables the entire affected functionality by default, and the researchers now recommend that release or newer while stating they have not verified it (see the update below). No in-the-wild exploitation is reported by any party.

Triage: requests to /.well-known/mta-sts. are not inherently hostile; MTA-STS is a real mail-security mechanism and a policy fetch is ordinary. Two things separate the leak from that traffic in web-server access logs: a legitimate client fetches mta-sts.txt at the documented path, whereas exploitation requests a varying stream of extensions that do not exist, and it repeats; the leak returns whatever happens to be in reused heap, so an attacker polls rather than fetching once. A run of 200 responses to distinct non-existent extensions from one source is the signal; a single mta-sts.txt fetch is not.