CVE-2026-54217 is a stored XSS vulnerability in the Webbox component of Tobit Laboratories AG TeamDavid. The flaw allows an attacker to embed malicious JavaScript in an email message. When a user accesses the email, the script executes, potentially leading to client-side code execution. The issue is classified under CWE-20 (Improper Input Validation). The vulnerability affects all versions prior to Rollout 528. From Rollout 528 onward, the vulnerable functionality is disabled by default, reducing the attack surface.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing a malicious email. This can lead to session hijacking, information disclosure, or other client-side impacts typical of stored XSS. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and user interaction needed.

The vulnerability is mitigated starting with TeamDavid Rollout 528 (June 30, 2026), where the affected functionality is disabled by default. Users and administrators should upgrade to Rollout 528 or later to ensure this protection. No other official patches or fixes are indicated. Until upgrading, caution is advised when opening emails from untrusted sources.