VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Feb 20, 2026· Updated Jun 17, 2026

CVE-2026-26747

CVE-2026-26747

Description

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Monicahq/Monica2 versions
    cpe:2.3:a:monicahq:monica:4.1.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:monicahq:monica:4.1.2:*:*:*:*:*:*:*
    • (no CPE)range: <4.1.2
  • Monica/Monicacpe-rescue

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.