CVE Explorer
CVE-2026-25808
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"hollo","vendor":"fedify-dev","versions":[{"status":"affected","version":"< 0.6.20, 0.7.2"},{"status":"affected","version":">= 7.0.0, < 0.7.2"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/fedify-dev/hollo/commit/329969c502ef092d5c3f9c2c20421c34f4ff0f0e","tags":["x_refsource_MISC"],"url":"https://github.com/fedify-dev/hollo/commit/329969c502ef092d5c3f9c2c20421c34f4ff0f0e"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/references/1
{"name":"https://github.com/fedify-dev/hollo/releases/tag/0.6.20","tags":["x_refsource_MISC"],"url":"https://github.com/fedify-dev/hollo/releases/tag/0.6.20"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/references/2
{"name":"https://github.com/fedify-dev/hollo/releases/tag/0.7.2","tags":["x_refsource_MISC"],"url":"https://github.com/fedify-dev/hollo/releases/tag/0.7.2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/references/3
{"name":"https://github.com/fedify-dev/hollo/security/advisories/GHSA-6r2w-3pcj-v4v5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/fedify-dev/hollo/security/advisories/GHSA-6r2w-3pcj-v4v5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b4b6326696c7644bf531a659e8885c47f60c3d6084b7aa5e2d07eb2481deec97 · sha256:31282ef0f5a5dc44… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.