CVE-2026-26747

Monica version 4.1.2 is vulnerable to a Host Header Poisoning attack due to the improper handling of the HTTP Host header within the app/Providers/AppServiceProvider.php file. This issue is compounded by a default misconfiguration where the app.force_url parameter is not set and defaults to "fals...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...