Tobit Laboratories AG TeamDavid's Webbox fails to enforce authentication or authorization when serving log files. This missing authorization (CWE-862) allows unauthorized attackers to retrieve sensitive error information or internal application details, which could facilitate further attacks. The vulnerability affects versions of TeamDavid up to and including Rollout 524. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality and security capabilities.

Attackers can access sensitive error logs and internal application details without authentication or authorization. This exposure may aid attackers in reconnaissance and planning further attacks against the system. However, there is no indication of direct code execution or data modification from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Webbox log files through network controls or other compensating measures to prevent unauthorized access.