EUVD-2026-42277
GHSA-cx9x-h2c8-vhx5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, low-complexity dbId enumeration yielding unauthorized record reads gives C:H with no integrity or availability impact; PR:N retained per source though an app session may be required (AC/PR could rise if so).
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
3DescriptionCVE.org
In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.
AnalysisAI
Sensitive user-record disclosure in Adalo's no-code app builder (App Builder versions 1 and 2) lets remote actors enumerate the internal 'dbId' identifier to retrieve complete user records and correlate individuals' behavior across multiple applications hosted on the platform. The flaw stems from predictable/enumerable record identifiers combined with absent access controls and no data minimization. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability very low (0.15%, 5th percentile) despite the high confidentiality-only CVSS of 7.5.
Technical ContextAI
Adalo is a hosted no-code/low-code platform used to build and run mobile and web applications backed by a shared managed database. The vulnerability centers on the 'dbId' - an internal database record identifier that is apparently sequential or otherwise predictable and exposed to clients. Because the platform does not enforce object-level authorization on requests keyed by dbId, an actor can iterate identifier values (an enumeration / Insecure Direct Object Reference pattern) to read records belonging to other users and even other applications on the multi-tenant backend. The CWE is listed as N/A in the source data; the behavior corresponds to the CWE-200 (Exposure of Sensitive Information) / CWE-639 (Authorization Bypass Through User-Controlled Key) class, compounded by the vendor's stated lack of data minimization and privacy-by-design safeguards.
RemediationAI
No vendor-released patch version is identified in the available data; treat remediation as vendor-driven since Adalo is a hosted platform, and monitor CERT/CC VU#849433 (https://kb.cert.org/vuls/id/849433) and the NVD entry for fix announcements. App owners cannot patch the platform themselves, so apply compensating controls: minimize the personal and sensitive data stored in Adalo collections (store only what the app truly needs, since the disclosed root cause is missing data minimization); avoid keeping high-value PII, secrets, or cross-app-linkable identifiers in Adalo-managed records; where the app design allows, gate sensitive collections behind authenticated, per-user filtered views rather than broadly readable ones - noting this can break unauthenticated features that currently rely on open reads. Because exposure is driven by predictable dbId access, request that Adalo implement object-level authorization and non-sequential identifiers, and ask the vendor directly whether a fixed build is available before assuming exposure is closed.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today