Adalo No‑Code App Builder exposes user data through its minimal leaderboard component, which returns email addresses, UUIDs, and custom fields without requiring any application‑specific secrets. The underlying weakness stems from wildcard CORS configuration, long‑lived twenty‑day JWTs, and an absence of token revocation, resulting in an authorization bypass that allows attackers to harvest personal information. This vulnerability is classified under improper authorization and insufficient credential protection.

All installations of Adalo No‑Code App Builder that deploy the default leaderboard component are affected. The CNA data does not specify version limits, so every current and legacy deployment that includes the component is potentially exposed.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% points to a low but non‑zero probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by sending a single request to the leaderboard endpoint, gaining access to sensitive personal data throughout the twenty‑day window in which the JWT remains valid. Because the tokens cannot be revoked, the attack surface persists for the entire token lifetime, enabling repeated harvesting by the same actor.