CVE-2026-32616

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32616", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-12T14:54:24.271Z", "datePublished": "2026-03-13T21:12:40.529Z", "dateUpdated": "2026-03-16T16:46:32.353Z"}, "containers": {"cna": {"title": "Pigeon has a Host Header Injection in email verification flow", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr"}, {"name": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201", "tags": ["x_refsource_MISC"], "url": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201"}], "affected": [{"vendor": "kasuganosoras", "product": "Pigeon", "versions": [{"version": "< 1.0.201", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T21:12:40.529Z"}, "descriptions": [{"lang": "en", "value": "Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201."}], "source": {"advisory": "GHSA-rrj4-9wgq-prcr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T16:46:26.154262Z", "id": "CVE-2026-32616", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T16:46:32.353Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T16:46:26.154262Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T16:46:29.485Z"}}], "cna": {"title": "Pigeon has a Host Header Injection in email verification flow", "source": {"advisory": "GHSA-rrj4-9wgq-prcr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kasuganosoras", "product": "Pigeon", "versions": [{"status": "affected", "version": "< 1.0.201"}]}], "references": [{"url": "https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr", "name": "https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201", "name": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T21:12:40.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32616", "state": "PUBLISHED", "dateUpdated": "2026-03-16T16:46:32.353Z", "dateReserved": "2026-03-12T14:54:24.271Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T21:12:40.529Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Pigeon", "vendor": "kasuganosoras", "versions": [{"status": "affected", "version": "< 1.0.201"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201."}, {"lang": "es", "value": "Pigeon es un tabl\u00f3n de mensajes/bloc de notas/sistema social/blog. Antes de 1.0.201, la aplicaci\u00f3n utiliza $_SERVER['HTTP_HOST'] sin validaci\u00f3n para construir URLs de verificaci\u00f3n de correo electr\u00f3nico en los flujos de registro y resendmail. Un atacante puede manipular el encabezado Host en la solicitud HTTP, haciendo que el enlace de verificaci\u00f3n enviado al correo electr\u00f3nico del usuario apunte a un dominio controlado por el atacante. Esto puede llevar a la toma de control de cuenta mediante el robo del token de verificaci\u00f3n de correo electr\u00f3nico. Esta vulnerabilidad est\u00e1 corregida en 1.0.201."}], "id": "CVE-2026-32616", "lastModified": "2026-06-17T10:36:06.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32616", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T16:46:26.154262Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:39.393", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201"}, {"source": "security-advisories@github.com", "url": "https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.201)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Pigeon", "source": "cna", "vendor": "kasuganosoras"}, "product": "pigeon", "vendor": "kasuganosoras"}], "analysis": {"en": {"generated_at": "2026-03-19T15:40:40.518441+00:00", "value": {"mitigation_remediation": ["Upgrade Pigeon to version 1.0.201 or newer to eliminate the Host Header Injection flaw."], "summary": {"action": "Patch", "impact": "Account Takeover via Host Header Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Pigeon message board/notepad/system from kasuganosoras. Any deployment of Pigeon with a version prior to 1.0.201 is susceptible. Version 1.0.201 and later contain the fix. No other products are listed.", "description_and_impact": "Pigeon uses the HTTP Host header without validation when creating email verification URLs in the register and resendmail flows. An attacker can inject a malicious Host header in a request, causing the verification link that is emailed to the user to point to an attacker-controlled domain. When the victim clicks the link, the attacker can capture the verification token and complete the account takeover. This flaw is a classic Host Header Injection, classified as CWE-74.", "risk_and_exploitability": "The CVSS score of 8.2 indicates high severity and the flaw is exploitable remotely via a crafted HTTP request. However, the EPSS score is below 1%, suggesting that the likelihood of exploitation is low and it is not yet listed in the KEV catalog. The risk remains significant for systems that have not been upgraded because an attacker who can forge the Host header can obtain an email verification token and take over legitimate user accounts."}}}}, "created": "2026-03-16T09:22:47.772205+00:00", "updated": "2026-03-23T13:39:24.284536+00:00", "vendors": ["kasuganosoras", "kasuganosoras$PRODUCT$pigeon"]}