CVE-2026-10708
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.
Risk Assessment
The organization is at risk of leaking personal user data (emails, UUIDs) and custom field information, potentially leading to privacy breaches, loss of trust, and legal consequences.
Recommendation
Immediately reduce JWT token lifetime, implement token revocation mechanisms, and restrict CORS policy to trusted domains. Additionally, audit leaderboard components to limit the data returned.
Other vulnerabilities in Adalo
Original NVD description (English source)
This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.