Tobit Laboratories AG TeamDavid's Webbox fails to enforce authentication or authorization when serving log files, leading to unauthorized access to sensitive error and internal application information. This missing authorization (CWE-862) vulnerability affects versions up to Rollout 524. The CVSS 4.0 base score is 6.9, indicating a medium severity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Attackers can obtain sensitive error information or internal application details without authentication, potentially facilitating further attacks. However, there is no indication of direct system compromise or data modification from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Webbox component and its log files through network controls or other access restrictions to prevent unauthorized access.