CVE-2026-10708

Name of the Vulnerable Software and Affected Versions Adalo (affected versions not specified)

Description This issue allows large-scale data harvesting without the need for app-specific secrets. A single request to a minimal leaderboard component can return user records that include emails, UUIDs, and custom fields. This is made possible by a combination of wildcard CORS (Cross-Origin Resource Sharing, a mechanism that allows restricted resources on a web page to be requested from another domain) behavior, long-lived twenty-day JWTs (JSON Web Tokens, a compact way to securely transmit information between parties as a JSON object), and the lack of token revocation, enabling the collection of sensitive personal information from any application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.