{"id":"CVE-2026-25808","aliases":["EUVD-2026-6393","GHSA-6r2w-3pcj-v4v5"],"status":"published","title":"Hollo DMs get leaked and can be seen on Webfinger Browser","description":"Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00489,"percentile":0.42413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-02-09T21:50:10Z","modified":"2026-10-28T02:30:55Z","products":[{"vendor":"fedify","product":"hollo"},{"vendor":"fedify-dev","product":"hollo"}],"references":[{"url":"https://github.com/fedify-dev/hollo/security/advisories/GHSA-6r2w-3pcj-v4v5","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/fedify-dev/hollo/commit/329969c502ef092d5c3f9c2c20421c34f4ff0f0e","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/fedify-dev/hollo/releases/tag/0.6.20","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/fedify-dev/hollo/releases/tag/0.7.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25808.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25808","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25808","title":"Hollo DMs get leaked and can be seen on Webfinger Browser","description":"Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.","status":"published","published":"2026-02-09T21:50:10.579Z","modified":"2026-02-10T21:23:34.888Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-6393","description":"Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.","status":"published","published":"2026-02-09T21:50:10Z","modified":"2026-02-10T21:23:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:41.699812Z"}],"nvd":[{"id":"CVE-2026-25808","description":"Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.","status":"published","published":"2026-02-09T22:16:02.44Z","modified":"2026-06-17T10:25:16.7Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-25808","title":"Hollo DMs get leaked and can be seen on Webfinger Browser","description":"Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.","status":"published","published":"2026-02-09T21:50:10.579Z","modified":"2026-10-28T02:30:55.919545209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:59.80315Z"}]}}