CVE-2026-54203

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525

Description A memory leak in the Webbox component allows an unauthorized actor to read sensitive information, including user passwords. This occurs when the application responds with memory contents upon accessing the endpoint "/.well-known/mta-sts.". An attacker can retrieve this data by making repeated requests to the endpoint without requiring authentication.

Recommendations Update TeamDavid to a version later than Rollout 524. As a temporary mitigation, restrict access to the "/.well-known/mta-sts." endpoint.