CVE-2026-10708
Insufficiently Protected Credentials
CVSS Score
7.5
EPSS Score
0.1%
EPSS Percentile
1th
This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.
| Vendor | adalo no-code app builder |
| Product | app builder |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for adalo no-code app builder app builder
Be the first to know when new high vulnerabilities affecting adalo no-code app builder app builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Adalo No-Code App Builder / App Builder
1 ≤ 2