VULNERABILITY INTELLIGENCE
CVE-2026-10706
CVSS score7.5 HIGH
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-07-08
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.