CVE-2026-25808

HighPublic PoC

Published: 09 February 2026

Published

09 February 2026

Modified

28 February 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0003 7.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25808 is a high-severity Missing Authorization (CWE-862) vulnerability in Fedify Hollo. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-25808 is a missing authorization vulnerability (CWE-862) in Hollo, a federated single-user microblogging software that integrates with ActivityPub for federation. In versions prior to 0.6.20 and 0.7.2, direct messages (DMs) and followers-only posts are exposed via the ActivityPub outbox endpoint without requiring proper authentication or authorization checks. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for privileges or user interaction.

The issue allows unauthenticated remote attackers to access the outbox endpoint over the network, enabling them to retrieve sensitive content such as DMs and followers-only posts that should be restricted. Exploitation requires no special privileges, making it accessible to any internet-connected adversary who can reach the affected Hollo instance.

Mitigation is available through patches released for the affected versions: upgrade to Hollo 0.6.20 or 0.7.2, as detailed in the project releases and the specific commit fixing the authorization flaw. The GitHub security advisory GHSA-6r2w-3pcj-v4v5 provides further details on the issue and resolution.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-6393

Vulnerability details

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is…

fixed in 0.6.20 and 0.7.2.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Missing authorization on public ActivityPub outbox directly enables T1190 (exploit of internet-facing service) for unauthorized retrieval of local sensitive data (DMs/posts), mapping to T1005.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1