EUVD-2026-42276
GHSA-gv53-r5jh-4pc3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Single unauthenticated network request returns PII with no secrets (AV:N/AC:L/PR:N/UI:N); confidentiality-only exposure, so C:H and I/A:N.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
3DescriptionCVE.org
This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.
AnalysisAI
Sensitive information disclosure in Adalo App Builder (versions 1 through 2) lets remote unauthenticated attackers harvest personal data at scale by sending a single request to a minimal leaderboard component, returning user records that include emails, UUIDs, and custom fields. The flaw stems from wildcard CORS behavior combined with long-lived twenty-day JWTs and no token revocation, meaning any Adalo application can be scraped without app-specific secrets. No public exploit is identified at time of analysis, and the EPSS score is low (0.10%), but the network-reachable, no-authentication nature makes mass automated collection straightforward.
Technical ContextAI
Adalo is a no-code platform for building mobile and web applications, where backend data services are shared across customer apps. The vulnerability lies in the API layer serving app components: a leaderboard endpoint returns full user records rather than a minimized public projection. Three compounding weaknesses drive the impact - a permissive wildcard CORS policy that allows any origin to read cross-origin API responses (browser-based cross-site data theft), twenty-day JWT lifetimes that keep credentials valid far too long, and the absence of any token revocation mechanism, so leaked or captured tokens cannot be invalidated. Root cause maps to broad exposure of sensitive information to unauthorized actors (CWE-200/CWE-201 class) and overly permissive cross-origin resource sharing (CWE-942); the CVE record lists CWE as N/A, so the classification is inferred from the description rather than assigned by NVD.
RemediationAI
No specific vendor-released fix version is identified in the available data, so track the CERT/CC note (https://kb.cert.org/vuls/id/849433) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-10708) for a patched App Builder release and apply it once published. As compensating controls, tighten the CORS policy to an explicit allowlist of trusted origins instead of a wildcard so browsers block unauthorized cross-origin reads (side effect: legitimate third-party integrations calling the API from other origins will break and must be enumerated first); shorten JWT lifetimes well below twenty days and introduce a revocation/blocklist mechanism so compromised tokens can be invalidated (side effect: users re-authenticate more often); and restrict or minimize the leaderboard component's response so it returns only non-sensitive public fields rather than full user records containing emails, UUIDs, and custom fields (side effect: apps relying on those fields in leaderboards lose that data). Since Adalo is a hosted platform, most of these controls ultimately depend on the vendor; app owners should also review what PII is stored in custom fields and remove anything unnecessary.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today