Vulnerability-Lookup

GHSA-JRWC-G36X-GQC7

Vulnerability from github – Published: 2026-08-07 12:31 – Updated: 2026-09-07 15:33

Details

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response.

This issue affects TeamDavid through Rollout 524.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-12071"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-07T10:16:56Z",
    "severity": "MODERATE"
  },
  "details": "The Webbox of TeamDavid by\u00a0Tobit Laboratories AG\u00a0constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server\u0027s HTTP \nresponse.\n\n\n\nThis issue affects TeamDavid through Rollout 524.",
  "id": "GHSA-jrwc-g36x-gqc7",
  "modified": "2026-09-07T15:33:44Z",
  "published": "2026-08-07T12:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12071"
    },
    {
      "type": "WEB",
      "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454"
    },
    {
      "type": "WEB",
      "url": "https://david.tobit.software/releasenotes"
    },
    {
      "type": "WEB",
      "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-12071 (GCVE-0-2026-12071)

Vulnerability from cvelistv5 – Published: 2026-08-07 09:40 – Updated: 2026-09-07 12:40

Title

TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters

Summary

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-10 11:19 UTC

CWE

CWE-601 - URL redirection to untrusted site ('open redirect')

Assigner

NCSC.ch mitre root

References

2 references

URL	Tags
https://chayns.net/77892-10814/tapp/763210?postId=11454	release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Tobit Laboratories AG	TeamDavid	Affected: 0 , < Rollout 528 (custom)

Credits

Dario Weiss of InfoGuard Labs Olivier Becker of InfoGuard Labs Lucas Dodgson of InfoGuard Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12071",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T11:19:50.374307Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T11:21:46.019Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Webbox"
          ],
          "product": "TeamDavid",
          "vendor": "Tobit Laboratories AG",
          "versions": [
            {
              "lessThan": "Rollout 528",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dario Weiss of InfoGuard Labs"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Olivier Becker of InfoGuard Labs"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucas Dodgson of InfoGuard Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe Webbox of TeamDavid by\u0026nbsp;Tobit Laboratories AG\u0026nbsp;constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server\u0027s HTTP \nresponse.\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects TeamDavid before Rollout 528.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "The Webbox of TeamDavid by\u00a0Tobit Laboratories AG\u00a0constructs redirect URLs using user-supplied input, \nwhich is appended to the redirect target in a 302 HTTP response. By \nusing URL-encoded characters such as \u201c%2e\u201d (representing a dot), an \nattacker can manipulate the portion of the URL following the top-level \ndomain (TLD). If a similar, registerable TLD exists (for example, if \n\u201c.com\u201d is the application\u2019s domain, and \u201c.company\u201d is available for \nregistration), an attacker can craft a URL to redirect users to a \nmalicious \u201c.company\u201d domain. By using URL-encoded line feeds, it becomes\n possible to insert arbitrary response headers in the server\u0027s HTTP \nresponse.\n\n\n\n\n\n\nThis issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL redirection to untrusted site (\u0027open redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T12:40:34.507Z",
        "orgId": "455daabc-a392-441d-aa46-37d35189897c",
        "shortName": "NCSC.ch"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
    "assignerShortName": "NCSC.ch",
    "cveId": "CVE-2026-12071",
    "datePublished": "2026-08-07T09:40:52.596Z",
    "dateReserved": "2026-06-12T09:32:52.061Z",
    "dateUpdated": "2026-09-07T12:40:34.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.