high7.5
CVE-2026-25808
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub.
Impact
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fedify | Hollo | from 0.6.0 before 0.6.20 from 0.7.0 before 0.7.2 |