CVE-2026-25808

Awaiting Analysis Awaiting Analysis - Queue

Unauthorized Data Exposure in Hollo ActivityPub Outbox Endpoint

Publication date: 2026-02-09

Last updated on: 2026-02-28

Assigner: GitHub, Inc.

Description

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-09

Last Modified

2026-02-28

Generated

2026-07-06

AI Q&A

2026-02-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25808

Affected Vendors & Products

Vendor	Product	Version / Range
fedify	hollo	From 0.6.0 (inc) to 0.6.20 (exc)
fedify	hollo	From 0.7.0 (inc) to 0.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The vulnerability exists in Hollo, a federated single-user microblogging software using ActivityPub. Before versions 0.6.20 and 0.7.2, direct messages (DMs) and followers-only posts could be accessed through the ActivityPub outbox endpoint without proper authorization.

This means that private communications and restricted posts were exposed to unauthorized users.

The issue was fixed in versions 0.6.20 and 0.7.2.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of private information, such as direct messages and posts intended only for followers.

Because the vulnerability allows exposure without authorization, sensitive or confidential communications could be accessed by unintended parties.

The CVSS base score of 7.5 indicates a high severity impact on confidentiality, though integrity and availability are not affected.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Hollo to version 0.6.20 or 0.7.2 or later, as these versions contain the fix that prevents unauthorized exposure of DMs and followers-only posts through the ActivityPub outbox endpoint.

Hi! I’m here to help you understand CVE-2026-25808. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70