CVE-2026-26747

CVE-2026-26747 describes a critical Host Header Poisoning vulnerability in Monica 4.1.2. This flaw arises from the application's improper handling of the HTTP Host header when generating absolute URLs, particularly in password reset emails, if the "app.force_url" setting is not explicitly configured. Attackers can manipulate the Host header to inject malicious links into these communications, potentially redirecting victims to attacker-controlled sites. Rated with a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to high confidentiality and integrity impacts. The primary risk is the poisoning of password reset links, enabling account takeover. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting a low level of public awareness at this time.