Saud Darwish

**Name of the Vulnerable Software and Affected Versions** Adalo versions 1 through 2 **Description** Attackers can extract complete user records and correlate user behavior across multiple applications through the enumeration of the `dbId` variable. This occurs because the platform lacks data minimization, privacy by design, and necessary technical safeguards, which leads to the exposure of sensitive information to unauthorized parties. **Recommendations** Update Adalo versions 1 through 2 to a version that implements appropriate technical safeguards and data minimization to prevent `dbId` enumeration.

**Name of the Vulnerable Software and Affected Versions** Adalo (affected versions not specified) **Description** This issue allows large-scale data harvesting without the need for app-specific secrets. A single request to a minimal leaderboard component can return user records that include emails, UUIDs, and custom fields. This is made possible by a combination of wildcard CORS (Cross-Origin Resource Sharing, a mechanism that allows restricted resources on a web page to be requested from another domain) behavior, long-lived twenty-day JWTs (JSON Web Tokens, a compact way to securely transmit information between parties as a JSON object), and the lack of token revocation, enabling the collection of sensitive personal information from any application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.