Description
In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.
Published: 2026-07-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Adalo’s no‑code app builder (versions 1 and 2) allows an attacker to enumerate database identifiers (dbId) and retrieve full user records. The platform does not enforce data minimization or privacy‑by‑design safeguards, so personal identifiers and other sensitive data can be exposed to unauthorized actors.

Affected Systems

The vulnerability exists in Adalo No‑Code App Builder releases 1 and 2. Attackers can enumerate database identifiers to retrieve full user records.

Risk and Exploitability

The flaw carries a CVSS score of 7.5, indicating a medium‑to‑high severity data‑exposure risk. The EPSS score of less than 1 % confirms a low probability of exploitation in the wild. Based on the description, it is inferred that the dbId parameter can be queried without authentication, making the vulnerability potentially exploitable once an attacker discovers valid identifiers. The likely attack vector is through the public API where dbId is accepted.

Generated by OpenCVE AI on August 4, 2026 at 07:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Adalo platform to the latest release that fixes the dbId enumeration flaw.
  • Restrict API access to authenticated users and enforce role‑based permissions so that only authorized administrators can query user data.
  • Limit API responses to essential fields and mask or omit sensitive data such as personal identifiers.
  • Implement rate limiting and monitoring on the API to detect abnormal enumeration patterns.

Generated by OpenCVE AI on August 4, 2026 at 07:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://kb.cert.org/vuls/id/849433 cve-icon cve-icon
History

Tue, 04 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-285

Fri, 31 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Sat, 25 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Tue, 21 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Thu, 16 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-285

Mon, 13 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-285

Sun, 12 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 10 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Adalo No-code App Builder
Adalo No-code App Builder app Builder
Vendors & Products Adalo No-code App Builder
Adalo No-code App Builder app Builder

Fri, 10 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Thu, 09 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Wed, 08 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.
Title Exposure of Sensitive Information to an Unauthorized attacker
References

Subscriptions

Adalo No-code App Builder App Builder
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-07-09T15:13:42.687Z

Reserved: 2026-06-02T17:46:45.590Z

Link: CVE-2026-10706

cve-icon Vulnrichment

Updated: 2026-07-09T15:13:35.113Z

cve-icon NVD

Status : Deferred

Published: 2026-07-08T15:16:25.287

Modified: 2026-07-09T19:49:55.763

Link: CVE-2026-10706

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T07:45:05Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-285

    Improper Authorization