CVE-2026-25808: Hollo Auth Bypass Vulnerability

CVE-2026-25808 Overview

CVE-2026-25808 is an authorization bypass vulnerability in Hollo, a federated single-user microblogging software that leverages the ActivityPub protocol for federation. Prior to versions 0.6.20 and 0.7.2, the application exposed private content—including direct messages (DMs) and followers-only posts—through the ActivityPub outbox endpoint without proper authorization checks.

Critical Impact
Unauthorized access to private messages and restricted posts through the ActivityPub outbox endpoint, potentially exposing sensitive user communications to any unauthenticated remote actor.

Affected Products

Hollo versions prior to 0.6.20
Hollo versions 0.7.x prior to 0.7.2
All Hollo instances using the ActivityPub outbox endpoint without the security patch

Discovery Timeline

2026-02-09 - CVE-2026-25808 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25808

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when a software component does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of Hollo, the ActivityPub outbox endpoint—designed to serve a user's public posts to federated servers—failed to filter out private content types before returning results.

The ActivityPub protocol defines an outbox as a collection of outgoing activities from an actor. While public posts should be accessible to any requesting party, private content such as direct messages and followers-only posts require proper authorization verification before disclosure. The vulnerable code path returned all posts belonging to an account owner without validating the visibility settings of each post.

Root Cause

The root cause stems from a missing authorization check in the database query that retrieves posts for the ActivityPub outbox. The original implementation queried posts based solely on the account ID without filtering by visibility level. This meant that posts with private, direct, or followers visibility settings were included in outbox responses alongside public and unlisted posts.

Attack Vector

An attacker could exploit this vulnerability by sending unauthenticated requests to the ActivityPub outbox endpoint of any Hollo instance. The attack is network-based and requires no authentication, no user interaction, and low complexity to execute. By querying the outbox endpoint with pagination parameters, an attacker could enumerate and retrieve all posts—including sensitive private communications—from any user on the vulnerable instance.

typescript

       });
       if (owner == null) return null;
       const items = await db.query.posts.findMany({
-        where: eq(posts.accountId, owner.id),
+        where: and(
+          eq(posts.accountId, owner.id),
+          inArray(posts.visibility, ["public", "unlisted"]),
+        ),
         orderBy: desc(posts.published),
         offset: Number.parseInt(cursor),
         limit: 41,

Source: GitHub Commit 329969c

The patch adds a visibility filter to the database query, ensuring only public and unlisted posts are returned through the outbox endpoint. Posts marked as private, direct, or followers are now properly excluded from unauthenticated outbox responses.

Detection Methods for CVE-2026-25808

Indicators of Compromise

Unusual volume of requests to ActivityPub outbox endpoints (/users/{username}/outbox)
Access patterns showing systematic pagination through outbox collections
Requests to outbox endpoints from unfamiliar or suspicious federated instances
Anomalous traffic patterns targeting user outbox endpoints without corresponding authentication

Detection Strategies

Monitor web server access logs for high-frequency requests to /outbox endpoints
Implement rate limiting on ActivityPub endpoints to detect enumeration attempts
Review audit logs for bulk data retrieval patterns against user activity streams
Deploy application-layer monitoring to flag unauthenticated access to sensitive content types

Monitoring Recommendations

Enable detailed logging for all ActivityPub federation endpoints
Set up alerts for abnormal request volumes targeting outbox collections
Audit historical access logs to identify potential prior exploitation
Monitor for data exfiltration patterns in network traffic analysis tools

How to Mitigate CVE-2026-25808

Immediate Actions Required

Upgrade Hollo to version 0.6.20 or 0.7.2 immediately
Audit access logs to identify any potential unauthorized access to private content
Notify affected users if evidence of exploitation is discovered
Review all federated connections for suspicious activity

Patch Information

The vulnerability has been addressed in Hollo versions 0.6.20 and 0.7.2. The fix implements proper visibility filtering in the database query for the ActivityPub outbox endpoint, ensuring only public and unlisted posts are exposed. For detailed patch information, see the GitHub Security Advisory GHSA-6r2w-3pcj-v4v5 and the specific commit 329969c.

Workarounds

If immediate patching is not possible, consider temporarily disabling the ActivityPub outbox endpoint
Implement a reverse proxy rule to block unauthenticated access to outbox endpoints
Restrict outbox access to authenticated federated servers only via firewall rules

bash

# Example nginx configuration to restrict outbox access
location ~ ^/users/.*/outbox {
    # Temporarily deny all access until patched
    deny all;
    # Or implement IP allowlist for trusted federated servers
    # allow 192.168.1.0/24;
}