Adalo No-Code App Builder Data Exposure Vulnerability

Executive Summary

CVE-2026-10706 is a critical vulnerability in Adalo’s no-code application platform (versions 1 and 2) that allows attackers to extract full user records and correlate user behavior across multiple applications by enumerating database IDs (dbId).

The root cause is a lack of proper authorization controls in the database API, which lets authenticated users retrieve complete user data—including fields not explicitly requested—belonging to any Adalo application, regardless of ownership or configuration.

This issue is worsened by a permissive CORS policy and the fact that deleted records may still be accessible. Additionally, long-lived JWT tokens (valid for about 20 days) are exposed in client-side requests, enabling attackers to reuse tokens from any origin to query the API without app-specific secrets.

The platform also does not implement data minimization, privacy by design, or appropriate technical safeguards, which allows sensitive information to be exposed to unauthorized parties.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access and exposure of sensitive user data such as emails, UUIDs, and custom fields across over one million applications built on Adalo.

Attackers can harvest large amounts of user information, potentially enabling phishing attacks, identity theft, and other malicious activities.

Because the vulnerability allows data extraction across multiple applications regardless of ownership, it poses a significant privacy risk to users and organizations relying on the platform.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability negatively impacts compliance with common data protection standards and regulations such as GDPR and HIPAA because the platform fails to implement data minimization, privacy by design, and appropriate technical safeguards.

Exposing sensitive user information to unauthorized parties violates principles of data confidentiality and integrity required by these regulations.

Organizations using Adalo’s platform may face legal and regulatory consequences due to this exposure if they do not take mitigating actions.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unauthorized or unusual API requests that attempt to enumerate dbId values or retrieve full user records across multiple applications. Since the vulnerability allows authenticated users to access complete user data via the database API, network traffic inspection should focus on API calls that request user data beyond expected scopes.

Commands or methods to detect exploitation attempts could include capturing and analyzing HTTP requests to the Adalo API endpoints, looking for repeated or automated queries that enumerate user IDs or request large volumes of user data.

• Use network packet capture tools like tcpdump or Wireshark to filter HTTP traffic to Adalo API endpoints.
• Example tcpdump command to capture HTTP traffic to Adalo API: tcpdump -i <interface> -A 'tcp port 443 and host <adalo_api_host>'
• Inspect logs or use tools like curl or Postman to manually test API endpoints for unauthorized data access by attempting to enumerate dbId values.
• Monitor for long-lived JWT tokens being used from unexpected origins or in unusual patterns, as these tokens can be reused to query the API.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the storage of sensitive information in Adalo collections until a patch is released, as the platform currently lacks proper authorization controls and technical safeguards.

Additionally, users should monitor and restrict access to long-lived JWT tokens, as their reuse from any origin enables large-scale data harvesting.

• Avoid storing sensitive user data in Adalo applications.
• Revoke or rotate any exposed JWT tokens if possible.
• Implement additional application-level access controls or data minimization outside of Adalo where feasible.
• Stay informed about updates from Adalo regarding patches or fixes for this vulnerability.

Useful 0 Not Useful 0