A missing authorization vulnerability in Hollo allows unauthenticated remote attackers to access private ActivityPub content, posing a significant risk to user data confidentiality.

The application fails to perform necessary authorization checks on the ActivityPub outbox endpoint, allowing unauthenticated users to retrieve restricted content including direct messages and followers-only posts.

The exploitation of this vulnerability results in the unauthorized disclosure of private communications, which can lead to significant privacy violations and reputational damage for individuals or organizations using the platform. With a CVSS score of 7.5, the vulnerability is classified as High due to the ease of exploitation over the network without requiring authentication. Failure to address this flaw could lead to the mass exfiltration of sensitive federated data.

Immediate Action: Update the Hollo instance to version 0.6.20 or 0.7.2 immediately to apply the necessary authorization logic.

Proactive Monitoring: Review ActivityPub outbox access logs for unusual patterns or high-frequency requests originating from unrecognized federated instances.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall to filter traffic to the outbox endpoint if immediate patching is not feasible.

Public Exploit Available: Unknown.

Given the high CVSS severity and the exposure of sensitive user communications, administrators must prioritize this update. The ability for unauthenticated attackers to query the outbox endpoint makes this a high-value target for information gathering. Apply the provided fixes immediately to restore the confidentiality of your federated content.