# Adalo no-code platform exposes all user data

Published: 2026-07-08 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/40dfba81-a735-54d4-a0bd-54a9adfe35db/adalo-no-code-platform-exposes-all-user-data

> Platform-level flaws in Adalo's no-code app builder let authenticated users pull full user records from any Adalo application via broken authorization and long-lived JWTs.

Adalo, a SaaS no-code application platform, contains two platform-wide vulnerabilities that undermine the tenant isolation model it relies on. CVE-2026-10706 stems from the database API returning complete user records for any list component request rather than only the fields configured for display, because the backend lacks ownership-aware, server-side authorization checks. This allows authenticated users of one application to enumerate database and table identifiers belonging to other applications and pull full records, an issue worsened by a permissive CORS policy, plaintext file storage, and indications that deleted records may remain retrievable.

CVE-2026-10708 compounds this by exposing long-lived JWT tokens (valid ~20 days) in client-side requests. Because Adalo's API accepts requests from any origin and tokens are not revoked, a single token harvested from any visitor session can be reused externally to script automated, large-scale extraction of user data — including emails, UUIDs, and custom fields — without further interaction with the target application.

Both issues affect all Adalo-built applications across V1 and V2, reportedly over one million apps, and cannot be remediated by individual developers since the flaws exist at the platform level. Adalo has acknowledged the issues but has not yet released a patch; CERT/CC recommends tenants avoid storing sensitive data in Adalo collections and monitor for phishing or identity-theft attempts stemming from potential data exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10706, CVE-2026-10708

## Detection guidance (public sample)

### Adalo API Access via Non-Browser HTTP Client (Automated Data Extraction)

ATT&CK: T1552

Detects Adalo platform API requests carrying Bearer/JWT authorization headers from non-browser HTTP client User-Agents (scripting/automation libraries), consistent with harvested long-lived JWT tokens being replayed outside the originating application for bulk data extraction (CVE-2026-10708). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adalo API Access via Non-Browser HTTP Client (Automated Data Extraction)
id: 699403db-0509-5b6c-adbe-49c5d8af3a2f
status: experimental
logsource:
  category: proxy
  product: other
detection:
  selection_host:
    r-dns|contains:
    - adalo.com
    - api.adalo.com
  selection_auth:
    c-uri|contains: /api/
  selection_ua:
    c-useragent|contains:
    - python-requests
    - curl/
    - Go-http-client
    - PostmanRuntime
    - axios/
    - okhttp
    - Scrapy
  filter_browser:
    c-useragent|contains:
    - Mozilla/
    - Chrome/
    - Safari/
  condition: selection_host and selection_auth and selection_ua and not filter_browser
falsepositives:
- Legitimate server-to-server integrations or automated QA/monitoring scripts calling
  the Adalo API with an authorized service token
- Internal automation pipelines that legitimately call Adalo REST endpoints programmatically
level: medium
tags:
- attack.T1552
- attack.T1078
- attack.T1213
author: Vorant
```

### Cross-Origin Reuse of Adalo Session Token (Permissive CORS Abuse)

ATT&CK: T1078

Detects HTTP requests to Adalo API endpoints where the Origin/Referer header does not match the expected Adalo application domain, indicating a JWT/session token captured from one tenant application being replayed from an external origin due to permissive CORS, enabling unauthorized cross-tenant data pulls (CVE-2026-10708). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cross-Origin Reuse of Adalo Session Token (Permissive CORS Abuse)
id: 3e1e863d-623d-5f6f-80be-8cbd46d271f7
status: experimental
logsource:
  category: proxy
  product: other
detection:
  selection_host:
    r-dns|contains:
    - adalo.com
    - api.adalo.com
  selection_api:
    c-uri|contains: /api/
  selection_origin_mismatch:
    cs-referer|contains:
    - localhost
    - ngrok
    - repl.co
    - glitch.me
    - burpcollaborator
  condition: selection_host and selection_api and selection_origin_mismatch
falsepositives:
- Developers testing Adalo-built applications locally or on tunneling/preview services
  (ngrok, Glitch, Replit) during legitimate development
- Security researchers performing authorized testing against their own Adalo application
level: medium
tags:
- attack.T1078
- attack.T1552
author: Vorant
```

### Cross-Tenant Enumeration of Adalo Database and Table Identifiers

ATT&CK: T1213

Detects requests to Adalo list-component/database API endpoints referencing sequential or varying database_id/table_id parameters from the same client, indicating enumeration of other tenants' collections due to missing ownership-aware authorization checks (CVE-2026-10706). Investigate for sustained high-volume requests with changing identifiers over a short window as a strong indicator of active exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cross-Tenant Enumeration of Adalo Database and Table Identifiers
id: 5707a2d8-2ed6-5c3a-9da8-830fab7f7bc0
status: experimental
logsource:
  category: proxy
  product: other
detection:
  selection_host:
    r-dns|contains:
    - adalo.com
    - api.adalo.com
  selection_endpoint:
    c-uri|contains:
    - /collections/
    - /database
    - /table
    - /records
  selection_method:
    cs-method: GET
  condition: selection_host and selection_endpoint and selection_method
falsepositives:
- Normal application runtime traffic where the app's own list components repeatedly
  query their configured database/table endpoints
- Load testing or QA automation exercising the Adalo API against a single application's
  own collections
level: low
tags:
- attack.T1213
- attack.T1552
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/849433

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/40dfba81-a735-54d4-a0bd-54a9adfe35db/adalo-no-code-platform-exposes-all-user-data.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup