A flaw in Hollo’s ActivityPub outbox endpoint allows any unauthenticated user to retrieve direct messages and follower‑only posts, exposing private content that is meant to be protected. The weakness falls under Unauthorized Access (CWE‑862) and primarily threatens confidentiality by letting attackers view confidential communications.

Vendors: fedify-dev for Hollo. Affected versions include all releases prior to 0.6.20 and 0.7.2; specifically Hollo 0.6.x older than 0.6.20 and Hollo 0.7.x older than 0.7.2 are vulnerable.

The vulnerability scores a CVSS of 7.5, indicating a high likelihood of impact if exploited. The EPSS score is below 1%, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. Exploitability requires only access to the public outbox endpoint; no authentication is needed. An attacker can retrieve private messages by querying the outbox endpoint and observing the returned ActivityPub payload.