CVE-2026-10708: Adalo Information Disclosure Vulnerability

CVE-2026-10708 Overview

CVE-2026-10708 is an information disclosure vulnerability affecting applications built on the Adalo no-code platform. A single request to a minimal leaderboard component returns user records containing emails, UUIDs, and custom fields without requiring app-specific secrets. The issue combines three weaknesses: wildcard Cross-Origin Resource Sharing (CORS) behavior, long-lived twenty-day JSON Web Tokens (JWTs), and the absence of token revocation. Attackers can harvest sensitive personal information at scale from any Adalo application by exploiting these design flaws.

Critical Impact
Attackers can perform large-scale harvesting of personal data — including emails, UUIDs, and custom user fields — from any Adalo-hosted application without authentication secrets.

Affected Products

Adalo no-code application platform
Applications built and hosted on Adalo containing user collections
Components exposing user records (including leaderboard components)

Discovery Timeline

2026-07-08 - CVE-2026-10708 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-10708

Vulnerability Analysis

The vulnerability enables unauthenticated data harvesting from Adalo-hosted applications. A single HTTP request to a minimal leaderboard component returns user records containing personally identifiable information (PII). No app-specific secrets are required to invoke the endpoint. The response payload includes email addresses, universally unique identifiers (UUIDs), and any custom fields defined on the user collection. Attackers can iterate across Adalo tenants and enumerate user data at scale.

Root Cause

Three design weaknesses combine to enable exploitation. First, the platform applies wildcard CORS behavior, permitting cross-origin requests from any origin. Second, issued JWTs remain valid for twenty days, extending the exposure window for any leaked token. Third, the platform provides no mechanism to revoke tokens, so compromised credentials cannot be invalidated before natural expiration. Together, these flaws remove standard boundaries that limit unauthenticated data access.

Attack Vector

An attacker identifies an Adalo application and issues a request to the leaderboard component endpoint. The wildcard CORS policy allows the request from any browser origin or automated client. The server returns user collection records that include email addresses, UUIDs, and custom fields. The attacker repeats the process across Adalo applications to aggregate a dataset of user information. Because tokens cannot be revoked, any credential obtained during an intrusion remains usable for the twenty-day lifetime.

No verified proof-of-concept code has been published. Refer to the CERT Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-10708

Indicators of Compromise

Unusual volumes of outbound requests to Adalo API endpoints associated with user-facing components such as leaderboards.
Repeated cross-origin requests to Adalo application endpoints from automated clients or unfamiliar origins.
JWTs issued by Adalo appearing in logs beyond expected user activity windows.

Detection Strategies

Inspect web server and CDN logs for high-frequency requests to Adalo component endpoints returning user collection data.
Correlate request patterns against expected user activity baselines for each Adalo application.
Monitor for CORS preflight and actual requests originating from unexpected Origin header values.

Monitoring Recommendations

Enable and retain access logs for all Adalo application endpoints that expose user records.
Alert on bulk enumeration patterns such as sequential UUID access or paginated scraping.
Track JWT issuance and usage anomalies, including tokens reused from unexpected geolocations.

How to Mitigate CVE-2026-10708

Immediate Actions Required

Review Adalo applications for components — including leaderboards — that expose user collection fields, and remove or restrict them where possible.
Reduce user collection fields to the minimum required for application function, eliminating unnecessary PII such as emails from public-facing components.
Contact Adalo support to confirm current CORS, JWT lifetime, and revocation policies for your tenant.

Patch Information

No vendor patch has been referenced in the published advisory. Consult the CERT Vulnerability Advisory for the current status of vendor remediation and coordinated disclosure updates.

Workarounds

Remove leaderboard and other components that surface user collection fields until the platform enforces stricter access controls.
Restrict user collection schemas so that sensitive fields such as email addresses are not stored alongside publicly queryable attributes.
Force user re-authentication and rotate application secrets where supported, acknowledging that existing JWTs cannot be revoked before expiration.
Place Adalo-hosted endpoints behind a reverse proxy or Web Application Firewall (WAF) capable of rate-limiting and origin-based filtering where feasible.

bash

# Example WAF rule concept: rate-limit unauthenticated requests to Adalo user endpoints
# Applied at an upstream reverse proxy in front of the Adalo application
limit_req_zone $binary_remote_addr zone=adalo_users:10m rate=10r/m;

location /api/users/ {
    limit_req zone=adalo_users burst=5 nodelay;
    if ($http_origin !~* ^https://(www\.)?your-approved-domain\.com$) {
        return 403;
    }
    proxy_pass https://your-adalo-backend;
}