CVE-2026-25808: Hollo DMs get leaked and can be seen on Webfinger Browser

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-09 · updated 2026-06-17
Weakness: CWE-862

Description

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.

Affected products

fedify-dev hollo: from 0.6.0 before 0.6.20; from 0.7.0 before 0.7.2 — fixed in 0.6.20, 0.7.2

How to fix

Upgrade to a fixed version: fedify-dev hollo 0.6.20, 0.7.2. Check the vendor advisory for mitigations.

References

https://github.com/fedify-dev/hollo/commit/329969c502ef092d5c3f9c2c20421c34f4ff0f0e
https://github.com/fedify-dev/hollo/releases/tag/0.6.20
https://github.com/fedify-dev/hollo/releases/tag/0.7.2
https://github.com/fedify-dev/hollo/security/advisories/GHSA-6r2w-3pcj-v4v5

Get alerted when CVE-2026-25808 or the next vulnerability affects your stack