CVE-2026-10706 — Exposure of Sensitive Information to an Unauthorized attacker

CVE-2026-10706

Exposure of Sensitive Information to an Unauthorized attacker PUBLISHED

Description (CNA)

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

Affected (CNA)

Vendor / product	Versions
Adalo No-Code App Builder / App Builder	affected 1 through 2

CWE

No CWE identifiers supplied.

References

https://kb.cert.org/vuls/id/849433

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.