Vulnerability Details CVE-2026-25808
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 3.0%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-25808
-
cpe:2.3:a:fedify:hollo:0.6.0
-
cpe:2.3:a:fedify:hollo:0.6.1
-
cpe:2.3:a:fedify:hollo:0.6.10
-
cpe:2.3:a:fedify:hollo:0.6.11
-
cpe:2.3:a:fedify:hollo:0.6.12
-
cpe:2.3:a:fedify:hollo:0.6.13
-
cpe:2.3:a:fedify:hollo:0.6.14
-
cpe:2.3:a:fedify:hollo:0.6.15
-
cpe:2.3:a:fedify:hollo:0.6.16
-
cpe:2.3:a:fedify:hollo:0.6.17
-
cpe:2.3:a:fedify:hollo:0.6.18
-
cpe:2.3:a:fedify:hollo:0.6.19
-
cpe:2.3:a:fedify:hollo:0.6.2
-
cpe:2.3:a:fedify:hollo:0.6.3
-
cpe:2.3:a:fedify:hollo:0.6.4
-
cpe:2.3:a:fedify:hollo:0.6.5
-
cpe:2.3:a:fedify:hollo:0.6.6
-
cpe:2.3:a:fedify:hollo:0.6.7
-
cpe:2.3:a:fedify:hollo:0.6.8
-
cpe:2.3:a:fedify:hollo:0.6.9
-
cpe:2.3:a:fedify:hollo:0.7.0
-
cpe:2.3:a:fedify:hollo:0.7.1