This vulnerability in Adalo No-Code App Builder enables unauthorized actors to access sensitive user information by enumerating database IDs (dbId). Due to insufficient implementation of data minimization and privacy principles, attackers can extract complete user records and correlate user behavior across multiple applications built on the platform. The CVSS score of 7.5 indicates a high-severity issue with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality without affecting integrity or availability. No patch or official remediation level has been provided, and no known exploits are reported in the wild as of the publication date.

Sensitive user information can be exposed to unauthorized parties, compromising user privacy and potentially enabling further privacy violations or targeted attacks. The confidentiality of user data is fully impacted, while integrity and availability remain unaffected.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/849433 for current remediation guidance. Until an official fix is available, users should consider limiting exposure of sensitive data and monitoring for unusual access patterns related to dbId enumeration.