diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ad1ba55e..4adb443fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,15 +9,33 @@ The format is based on [*Keep a Changelog*](https://keepachangelog.com/en/1.0.0/
 <!--
 ## [v0.108.0] – TBA
 
-## [v0.107.77] - 2026-06-01 (APPROX.)
+## [v0.107.78] - 2026-06-15 (APPROX.)
 
-See also the [v0.107.77 GitHub milestone][ms-v0.107.77].
+See also the [v0.107.78 GitHub milestone][ms-v0.107.78].
 
-[ms-v0.107.77]: https://github.com/AdguardTeam/AdGuardHome/milestone/112?closed=1
+[ms-v0.107.78]: https://github.com/AdguardTeam/AdGuardHome/milestone/113?closed=1
 
 NOTE: Add new changes BELOW THIS COMMENT.
 -->
 
+### Fixed
+
+- Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
+
+<!--
+NOTE: Add new changes ABOVE THIS COMMENT.
+-->
+
+## [v0.107.77] - 2026-06-01
+
+See also the [v0.107.77 GitHub milestone][ms-v0.107.77].
+
+### Security
+
+- Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.
+
+    **NOTE:** This is CVE-2026-41448. We thank @djnnvx for reporting this security issue.
+
 ### Added
 
 - New `reason` query parameter in `GET /control/querylog`.  See `openapi/openapi.yaml` for the full description.
@@ -26,13 +44,7 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 - Query parameter `response_status` in `GET /control/querylog` is now deprecated.  Use new `reason` query parameter instead.
 
-### Fixed
-
-- Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
-
-<!--
-NOTE: Add new changes ABOVE THIS COMMENT.
--->
+[ms-v0.107.77]: https://github.com/AdguardTeam/AdGuardHome/milestone/112?closed=1
 
 ## [v0.107.76] - 2026-05-21
 
@@ -58,8 +70,6 @@ See also the [v0.107.75 GitHub milestone][ms-v0.107.75].
 
 ### Security
 
-- Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.
-
 - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.3][go-1.26.3].
 
 - IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security.
@@ -3630,11 +3640,12 @@ See also the [v0.104.2 GitHub milestone][ms-v0.104.2].
 [ms-v0.104.2]: https://github.com/AdguardTeam/AdGuardHome/milestone/28?closed=1
 
 <!--
-[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.77...HEAD
-[v0.107.77]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.76...v0.107.77
+[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.78...HEAD
+[v0.107.78]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.77...v0.107.78
 -->
 
-[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.76...HEAD
+[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.77...HEAD
+[v0.107.77]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.76...v0.107.77
 [v0.107.76]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.75...v0.107.76
 [v0.107.75]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.74...v0.107.75
 [v0.107.74]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.73...v0.107.74
diff --git a/openapi/CHANGELOG.md b/openapi/CHANGELOG.md
index 951776251..b4523baac 100644
--- a/openapi/CHANGELOG.md
+++ b/openapi/CHANGELOG.md
@@ -2,13 +2,7 @@
 
 <!-- TODO(a.garipov): Reformat in accordance with the KeepAChangelog spec. -->
 
-## v0.107.76: API changes
-
-### Documentation fix for the `reason` query parameter in 'GET /control/querylog'
-
-- The `reason` query parameter documentation has been updated to reflect that this parameter is an array.
-
-## v0.107.75: API changes
+## v0.107.77: API changes
 
 ### New `reason` query parameter in 'GET /control/querylog'