CVE-2026-26747

Monica version 4.1.2 is vulnerable to a Host Header Poisoning attack due to the improper handling of the HTTP Host header within the app/Providers/AppServiceProvider.php file. This issue is compounded by a default misconfiguration where the app.force_url parameter is not set and defaults to "fals...