CVE-2026-25808 Hollo DMs get leaked and can be seen on Webfinger Browser
Attackers can view private direct messages and followers-only posts via the ActivityPub outbox endpoint without authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25808?
CVE-2026-25808 is a high-severity missing authorization vulnerability in fedify-dev hollo, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
Weakness: CWE-862
Which versions are affected by CVE-2026-25808?
It affects 1 product.
Products include Fedify Hollo.
How do I fix CVE-2026-25808?
No fix has been published for CVE-2026-25808 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25808 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25808 exists.
Sources
Also known as GHSA-6r2w-3pcj-v4v5.