CVE-2026-25808

Published: Feb 9, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.

Affected (2)

Products: Fedify: Hollo

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Fedify Hollo	From 0.6.0 to 0.6.20
Fedify Hollo	From 0.7.0 to 0.7.2

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://github.com/fedify-dev/hollo/commit/329969c502ef092d5c3f9c2c20421c34f4ff0f0e

Source: security-advisories@github.com

Patch

https://github.com/fedify-dev/hollo/releases/tag/0.6.20

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/fedify-dev/hollo/releases/tag/0.7.2

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/fedify-dev/hollo/security/advisories/GHSA-6r2w-3pcj-v4v5

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.