CVE-2026-10706

HighCVSS 7.5

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

In Adalo's no-code app builder (Versions 1 and 2), attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

Risk Assessment

The risk involves potential mass leakage of personal user data and profiling of user activity across applications, which may lead to violations of data protection regulations (e.g., GDPR) and loss of customer trust.

Recommendation

Immediately update Adalo to the latest version, implement authentication and authorization mechanisms for API endpoints, and restrict access to dbId identifiers through randomization or encryption.

Other vulnerabilities in Adalo

CVE-2026-10708High
This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.

Original NVD description (English source)

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.